ca29805dbca4a59486d4fa49c09cfe151b42fa54f9ced2f4954fd4ddd4b7d453

Sharing

Copy URL Twitter E-mail

General

Target

ca29805dbca4a59486d4fa49c09cfe151b42fa54f9ced2f4954fd4ddd4b7d453
Size

406KB
MD5

5fde3eff5782f32a3f446f6d9e4fb872
SHA1

3c4d81b214fc6a604bb30635479ffcda0d40740d
SHA256

ca29805dbca4a59486d4fa49c09cfe151b42fa54f9ced2f4954fd4ddd4b7d453
SHA512

0143ca6bf044b948554741dd9a814d6341e99b0c7c789762d38585056cf3d1bf5d742970f4abee3443b1a193dff0c990b8757e1991ac061ba1c5d5fc62f901fe
SSDEEP

3072:IPI12fvpN4yPtKUxEWe+cxZrxkhsAU1hPG6UUFx+0ys2O6QJNAXwLiutywluEMVV:ILhN4GJjh7WAU1hgE4RU7AXG6HoOVxwa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca29805dbca4a59486d4fa49c09cfe151b42fa54f9ced2f4954fd4ddd4b7d453

Files

ca29805dbca4a59486d4fa49c09cfe151b42fa54f9ced2f4954fd4ddd4b7d453
.dll windows:5 windows x86 arch:x86

f35802c5b4c983304b2892d7d96b4f0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\src\wix38\build\ship\x86\wixca.pdb

Imports

msi

ord121
ord8
ord17
ord125
ord47
ord64
ord80
ord103
ord34
ord171
ord74
ord73
ord145
ord120
ord118
ord116
ord143
ord26
ord166
ord163
ord160
ord159
ord162
ord32
ord124
ord49
ord51
ord119

advapi32

RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
LookupAccountSidW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
BuildTrusteeWithSidW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfig2W
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceConfig2W
RegCloseKey
RegOpenKeyExW
CreateWellKnownSid
LookupAccountNameW

user32

DispatchMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
RegisterClassW
UnregisterClassW
CreateWindowExW
IsWindow
TranslateMessage
GetMessageW
GetSystemMetrics
SendMessageTimeoutW
EnumWindows
GetWindowThreadProcessId
IsDialogMessageW

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocString

shell32

ShellExecuteW
SHGetFolderPathW

ole32

CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

GetConsoleCP
GetConsoleMode
OutputDebugStringW
SetStdHandle
GetModuleFileNameA
RtlUnwind
LoadLibraryExW
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetFileType
GetStdHandle
GetModuleHandleExW
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetWindowsDirectoryW
OpenProcess
TerminateProcess
GetLastError
SetLastError
CloseHandle
FreeLibrary
GetProcAddress
LocalFree
GetVersionExW
FindClose
FindFirstFileW
FindNextFileW
lstrcmpW
GetCurrentProcess
FormatMessageW
lstrcmpiW
WriteFile
GetTempPathW
CreateFileW
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
Sleep
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetCurrentProcessId
SetFilePointer
LoadLibraryW
WriteConsoleW
GetSystemDirectoryW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetExitCodeProcess
WaitForSingleObject
DuplicateHandle
CreatePipe
GetModuleHandleW
CreateProcessW
GetPriorityClass
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAlloc
GlobalFree
GetFileSizeEx
ReadFile
SetFilePointerEx
GetFileTime
SetFileTime
ExpandEnvironmentStringsW
GetFullPathNameW
SetFileAttributesW
DeleteFileW
InterlockedIncrement
InterlockedDecrement
GetProcessTimes
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameW
GetFileAttributesW
ExitProcess
GetModuleHandleA
GlobalDeleteAtom
GlobalAddAtomW
GlobalFindAtomW
GetTickCount
FlushFileBuffers

Exports

Exports

CAQuietExec
CAQuietExec64
CommitCAScriptCleanup
ExecSecureObjects
ExecSecureObjectsRollback
ExecServiceConfig
ExecXmlConfig
ExecXmlConfigRollback
ExecXmlFile
ExecXmlFileRollback
RollbackServiceConfig
SchedSecureObjects
SchedSecureObjectsRollback
SchedServiceConfig
SchedXmlConfig
SchedXmlFile
WixCheckRebootRequired
WixCloseApplications
WixCloseApplicationsDeferred
WixCreateInternetShortcuts
WixExitEarlyWithSuccess
WixFailWhenDeferred
WixQueryOsDirs
WixQueryOsDriverInfo
WixQueryOsInfo
WixQueryOsWellKnownSID
WixRegisterRestartResources
WixRemoveFoldersEx
WixRollbackInternetShortcuts
WixSchedInternetShortcuts
WixShellExec
WixShellExecBinary
WixWaitForEvent

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f35802c5b4c983304b2892d7d96b4f0d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

advapi32

user32

oleaut32

shell32

ole32

version

kernel32

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 96KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 3KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 96KB - Virtual size: 96KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 3KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 9KB