Captiva[.]exe | Triage

Sharing

General

Target

Captiva.exe
Size

7.0MB
MD5

8b7343c22fb99c26da8f3122c6cecdcd
SHA1

898ebaa6ae8293f24306475ea5029520a1533dbc
SHA256

fd37270bdce8937cc3cb0d4d99300f537daba57e70f36f40e4c767411f7938cd
SHA512

8d806c124656ebdf151f92ce9bb6024cb2fe17a5dafeb90c0ceff783c6e8c9044f00bc846727465f64f79946096d60d81d2434ae6cb05b6a18aee5bc05e4ba81
SSDEEP

98304:c3d8QkJDJ3m0R1yQXvCyCE28yW1cadMykTmERn50gxIbgSZtwzn05A4tcqQVIhvQ:p+0ncq/aDDWqR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Captiva.exe

Files

Captiva.exe
.exe windows:6 windows x86 arch:x86

Password: 7482

2b3730cda46affc8837a7df18591704a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetEnvironmentStringsW
GetTempPathW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
SetCriticalSectionSpinCount
Sleep
GetCurrentProcess
ExitProcess
GetSystemInfo
GetVersion
GetTickCount
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
MultiByteToWideChar
ConvertDefaultLocale

user32

IsWindowVisible
GetWindowContextHelpId
MessageBoxA
GetWindowLongW
IsDialogMessageW
RegisterClassW

Sections

.text
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ