capisp[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

capisp.dll.exe
Size

1.2MB
MD5

70b599f67e97cb878ca7be88e069a82d
SHA1

768f8a179fee1f13505c7b772e543b19b29b14c8
SHA256

9b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5
SHA512

163c8e0b2676a27f1781e9fdec3c9994ba828c0085b9fdff9df4dd0112da122a5d7f6ca597af396f99c2afadbe438e1ab967dfba34451ee4ba3c59cd244b4985
SSDEEP

24576:h2sNbyXYH2FWaJHnvpTLLs7e1G1oKEnUiiiziiiziiiciiicQ7r3PZQs:hxN+XYH2wadvpTLLsQKKr3P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
capisp.dll.exe

Files

capisp.dll.exe
.dll windows:4 windows x64 arch:x64

86e834d3d61509ce2f47957bd2f89dc1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

iphlpapi

GetAdaptersAddresses

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
CreateSemaphoreW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte

msvcrt

__C_specific_handler
___lc_codepage_func
__dllonexit
__iob_func
__mb_cur_max
_amsg_exit
_beginthreadex
_daylight
_endthreadex
_errno
_exit
_gmtime64
_initterm
_lock
_onexit
_setjmp
_strdup
_stricmp
_strnicmp
_time64
_tzset
_ultoa
_unlock
_vsnprintf
abort
atoi
calloc
exit
fclose
fopen
fopen_s
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
getenv
isalnum
isalpha
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
printf
rand
realloc
setlocale
signal
sprintf
srand
sscanf_s
strcat
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
vfprintf
wcscoll
wcsftime
wcslen
wcstombs_s
wcsxfrm
longjmp
_timezone
_write
_strdup
_open
_close

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getsockname
htonl
htons
inet_addr
ioctlsocket
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Exports

Exports

remi
vlc_entry_copyright__3_0_0f
vlc_entry_license__3_0_0f

Sections

.text
Size: 743KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 59KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86e834d3d61509ce2f47957bd2f89dc1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

iphlpapi

kernel32

msvcrt

ws2_32

Exports

Exports

Sections

.text Size: 743KB - Virtual size: 744KB

.data Size: 11KB - Virtual size: 12KB

.rdata Size: 67KB - Virtual size: 68KB

.buildid Size: 512B - Virtual size: 4KB

.pdata Size: 48KB - Virtual size: 48KB

.xdata Size: 59KB - Virtual size: 60KB

.bss Size: 12KB - Virtual size: 12KB

.edata Size: 512B - Virtual size: 4KB

.idata Size: 8KB - Virtual size: 8KB

.CRT Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 268KB - Virtual size: 268KB

.reloc Size: 5KB - Virtual size: 8KB

/4 Size: 512B - Virtual size: 28B

.text
Size: 743KB - Virtual size: 744KB

.data
Size: 11KB - Virtual size: 12KB

.rdata
Size: 67KB - Virtual size: 68KB

.buildid
Size: 512B - Virtual size: 4KB

.pdata
Size: 48KB - Virtual size: 48KB

.xdata
Size: 59KB - Virtual size: 60KB

.bss
Size: 12KB - Virtual size: 12KB

.edata
Size: 512B - Virtual size: 4KB

.idata
Size: 8KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 268KB - Virtual size: 268KB

.reloc
Size: 5KB - Virtual size: 8KB

/4
Size: 512B - Virtual size: 28B