cafeef076e5fadc9df98348701359a973c5b47478e6200b221d9f3b302d5717a

Sharing

Copy URL Twitter E-mail

General

Target

cafeef076e5fadc9df98348701359a973c5b47478e6200b221d9f3b302d5717a
Size

9.4MB
MD5

c7b4840f13dee5be09384825280a65ee
SHA1

5ca84c217491300897b23755e95731cfc7940bd1
SHA256

cafeef076e5fadc9df98348701359a973c5b47478e6200b221d9f3b302d5717a
SHA512

b3619b13a281e4ae26fadf75e94f30e5aba07a48c3c1bef90a59739ac6421e9f67e6a1200c74b0542c92411ac7e82b281daf2722334bd609c5dfac5eb8c46d92
SSDEEP

196608:TZtGb9AQKlsOFvN77EkNaSEVvlAx3/6jnFZQF9UwMeT7oArLN7:FceFlJXPaSWvlOc3c40oAN7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cafeef076e5fadc9df98348701359a973c5b47478e6200b221d9f3b302d5717a

Files

cafeef076e5fadc9df98348701359a973c5b47478e6200b221d9f3b302d5717a
.exe windows:5 windows x64 arch:x64

bb4af0636ba08616eacc0ec17d53984e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx
CreateDirectoryA

user32

wsprintfA
EnableWindow

shlwapi

ord158

mfc100

ord4920

msvcr100

__CxxFrameHandler3

advapi32

SetSecurityDescriptorDacl

comctl32

InitCommonControlsEx

ole32

CoCreateInstance

oleaut32

VariantClear

msvcp100

?_Xlength_error@std@@YAXPEBD@Z

ws2_32

WSAStartup

iphlpapi

GetAdaptersInfo

Sections

.text
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 671KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mark
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox
Size: - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vdata0
Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vdata1
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.virbox3
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb4af0636ba08616eacc0ec17d53984e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

mfc100

msvcr100

advapi32

comctl32

ole32

oleaut32

msvcp100

ws2_32

iphlpapi

Sections

.text Size: - Virtual size: 8.3MB

.rdata Size: - Virtual size: 671KB

.data Size: - Virtual size: 144KB

.pdata Size: - Virtual size: 18KB

.mark Size: - Virtual size: 1024B

.virbox Size: - Virtual size: 210KB

.vdata0 Size: - Virtual size: 5.7MB

.vdata1 Size: - Virtual size: 17KB

.virbox3 Size: 272KB - Virtual size: 272KB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: - Virtual size: 8.3MB

.rdata
Size: - Virtual size: 671KB

.data
Size: - Virtual size: 144KB

.pdata
Size: - Virtual size: 18KB

.mark
Size: - Virtual size: 1024B

.virbox
Size: - Virtual size: 210KB

.vdata0
Size: - Virtual size: 5.7MB

.vdata1
Size: - Virtual size: 17KB

.virbox3
Size: 272KB - Virtual size: 272KB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 17KB - Virtual size: 16KB