cacc1e46a08850b49394f25938532968b9c09a8ea2d313fd64da24dd676e1539

Sharing

Copy URL Twitter E-mail

General

Target
cacc1e46a08850b49394f25938532968b9c09a8ea2d313fd64da24dd676e1539
Size 5.9MB
Sample260816-txjl1ssvbx
SHA256 cacc1e46a08850b49394f25938532968b9c09a8ea2d313fd64da24dd676e1539
MD5 e44949c8a528db3a708d0e19b6d94375
SHA1 7547dd32c7c3f0a4c1fbd68506b0273ad417fa3d
SHA512 ee49143e10e3f18498b4c2a9f11d6b83bad9e3585e960a1a462308ec92069a2232eb12a95c12141291c2afc8d8454a4ad141d7a5fa11383a3540a688adf4a51e
SSDEEP 98304:eMuL8dj6f4wGNusLsUyxlkvVYdJi5Ah1NS699xzErPaOFQC:eGj6xEusfVYdJi2P9BtOFQC
TLSH
T13356C012BAD18471E66302306569B3BB4DBEFAA11B30C5CB739C162E4F719C19D3B762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cacc1e46a08850b49394f25938532968b9c09a8ea2d313fd64da24dd676e1539

File Explorer

cacc1e46a08850b49394f25938532968b9c09a8ea2d313fd64da24dd676e1539

.exe 5.9MB

cacc1e46a08850b49394f25938532968b9c09a8ea2d313fd64da24dd676e1539

IMPHASH b1c5b00705207dd0cd7732257f84f8dc
SHA256 cacc1e46a08850b49394f25938532968b9c09a8ea2d313fd64da24dd676e1539
MD5 e44949c8a528db3a708d0e19b6d94375
SHA1 7547dd32c7c3f0a4c1fbd68506b0273ad417fa3d
SHA512 ee49143e10e3f18498b4c2a9f11d6b83bad9e3585e960a1a462308ec92069a2232eb12a95c12141291c2afc8d8454a4ad141d7a5fa11383a3540a688adf4a51e
SSDEEP 98304:eMuL8dj6f4wGNusLsUyxlkvVYdJi5Ah1NS699xzErPaOFQC:eGj6xEusfVYdJi2P9BtOFQC
TLSH
T13356C012BAD18471E66302306569B3BB4DBEFAA11B30C5CB739C162E4F719C19D3B762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1546268

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CareUEyes.pdb

winmm

timeSetEvent mciSendStringW timeKillEvent

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

FindNextFileW GetFileAttributesExW GetCurrentDirectoryW MapViewOfFile GetVolumeInformationW GetFileAttributesW GetTempPathW CreateDirectoryW SetFilePointerEx SetEndOfFile FlushFileBuffers GetFileInformationByHandle CreateToolhelp32Snapshot GetFileSizeEx FormatMessageW TryEnterCriticalSection GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetVersionExW GetSystemInfo GetSystemDirectoryW GetTimeZoneInformation GetUserDefaultLangID FindFirstChangeNotificationW FindCloseChangeNotification WaitForMultipleObjects FindNextChangeNotification Process32FirstW Process32NextW ResetEvent OpenFileMappingW IsBadReadPtr GetSystemTime GetCurrentDirectoryA GetModuleFileNameA GetVersionExA HeapCreate FreeResource GetFullPathNameW SleepEx VerSetConditionMask QueryPerformanceFrequency VerifyVersionInfoW QueryPerformanceCounter MoveFileExA CompareFileTime GetFileType GetStdHandle PeekNamedPipe FormatMessageA InterlockedDecrement WriteFile UnmapViewOfFile SuspendThread GetThreadContext lstrlenA InterlockedIncrement VirtualFree GlobalAlloc VirtualAlloc FlushInstructionCache VirtualProtect GetEnvironmentVariableW GetEnvironmentVariableA CreateProcessW ResumeThread TerminateProcess FindFirstFileW ReadProcessMemory LoadLibraryExA LoadLibraryA GetComputerNameA OutputDebugStringW IsBadWritePtr SetLastError ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetDriveTypeW SetStdHandle GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW UnhandledExceptionFilter LocalFree GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetExitCodeThread SwitchToThread WaitForSingleObjectEx DuplicateHandle IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent lstrcmpW ExitProcess GlobalAddAtomA Sleep InterlockedCompareExchange GetModuleHandleA SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection GetProcessHeap FindClose ReadFile CreateFileMappingW GetFileSize GlobalLock GlobalUnlock MulDiv WideCharToMultiByte OutputDebugStringA DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateThread LoadLibraryW GetProcAddress FreeLibrary GetLastError CloseHandle SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCommandLineA GetModuleHandleW GetLocalTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineW SetCurrentDirectoryW InitializeCriticalSectionAndSpinCount lstrcmpiW LockResource SizeofResource FindResourceExW DecodePointer RaiseException MultiByteToWideChar DeleteFileW LoadResource FindResourceW LoadLibraryExW GetCurrentThread GetModuleFileNameW VirtualQuery GetCurrentThreadId CreateFileW

user32

ReleaseDC MessageBoxW GetActiveWindow IsWindowVisible GetFocus GetParent ShowWindow SetWindowPos DestroyWindow SendMessageW UnregisterClassW CharNextW PtInRect GetDC OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindow MsgWaitForMultipleObjects CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetClassLongW GetClassLongW RemovePropW GetPropW SetPropW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow OffsetRect DispatchMessageW FindWindowW GetWindowRect MonitorFromRect PostMessageW UnhookWinEvent SetWinEventHook GetForegroundWindow GetCursorPos WindowFromPoint GetMonitorInfoW BringWindowToTop GetUserObjectInformationW GetProcessWindowStation DrawIconEx SetWindowLongW SetForegroundWindow MonitorFromPoint GetSystemMetrics GetAsyncKeyState UnregisterHotKey RegisterHotKey EnumDisplayMonitors CopyRect ScreenToClient GetWindowLongW MonitorFromWindow GetClassNameW GetShellWindow GetAncestor LockWorkStation GetWindowThreadProcessId SystemParametersInfoW AttachThreadInput SetCapture GetCapture ReleaseCapture ClientToScreen InvalidateRect SetCursor SetActiveWindow PostQuitMessage GetDesktopWindow CreateWindowExW SetWindowTextW GetWindowTextW GetWindowTextLengthW MoveWindow GetClientRect BeginPaint EndPaint InvalidateRgn RedrawWindow SetFocus GetWindow IsChild GetDlgCtrlID GetDlgItem GetSysColor DestroyAcceleratorTable FillRect CreateAcceleratorTableW DefWindowProcW RegisterWindowMessageW GetClassInfoExW LoadCursorW CreatePopupMenu IsMenu IsWindowEnabled EnableWindow LoadImageW CreateIconFromResource LoadBitmapW GetIconInfo MapWindowPoints SetCaretPos HideCaret GetCaretBlinkTime CreateCaret UpdateWindow AnimateWindow TrackMouseEvent PeekMessageW EnableMenuItem TranslateMessage RegisterClassExW CallWindowProcW SetTimer KillTimer GetWindowLongA SetLayeredWindowAttributes IsIconic EnumDisplayDevicesW DestroyIcon SendMessageA GetWindowDC GetWindowRgn IsZoomed SetSysColors DestroyCursor GetMessageW EqualRect IsRectEmpty UnionRect IntersectRect InflateRect SetRect GetKeyState

gdi32

SetDeviceGammaRamp GetObjectW GetStockObject DeleteDC CreateCompatibleBitmap CreateSolidBrush DeleteObject SelectObject SetBkMode SaveDC SetViewportOrgEx CreateFontIndirectW EnumFontsW CreateRectRgn CreatePen SetROP2 CreateHatchBrush FrameRgn Rectangle SetGraphicsMode CreateRoundRectRgn ExcludeClipRect GetDeviceCaps RestoreDC ExtCreateRegion GetRegionData IntersectClipRect SelectClipRgn CreateDIBSection GetCurrentObject GetViewportOrgEx CreateBitmap StretchBlt GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign GetTextMetricsW SetWorldTransform ExtTextOutW GetTextFaceW GdiFlush BitBlt CreateCompatibleDC EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegNotifyChangeKeyValue RegQueryValueExW GetUserNameA RegDeleteValueW RegCreateKeyExW RegSetValueExW CryptEnumProvidersW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW Shell_NotifyIconW SHFileOperationW SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation ord680 ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance OleUninitialize CoTaskMemRealloc CLSIDFromString CLSIDFromProgID CoGetClassObject CoTaskMemFree OleLockRunning IIDFromString CoCreateGuid CreateBindCtx StringFromGUID2 CreateStreamOnHGlobal OleInitialize

oleaut32

SysAllocString VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocStringLen SysStringLen LoadTypeLi VariantInit VariantClear OleCreateFontIndirect DispCallFunc SysFreeString LoadRegTypeLi VarUdateFromDate

shlwapi

PathFileExistsW PathIsDirectoryW PathFindExtensionW PathRemoveFileSpecW PathAppendW StrToIntExW PathQuoteSpacesW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipImageGetFrameCount GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

dwmapi

DwmGetWindowAttribute

ws2_32

getsockname getpeername connect bind WSAGetLastError send recv closesocket getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom shutdown sendto gethostname socket getnameinfo

iphlpapi

GetAdaptersInfo

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

wldap32

ord208 ord41 ord46 ord145 ord216 ord14 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord301 ord133 ord147 ord219

usp10

ScriptShape ScriptItemize ScriptFreeCache

generic

count=41, id=241, version=40116,

count=206, id=243, version=40116,

count=41, id=242, version=40116,

count=9, id=199, version=41118,

count=28, id=259, version=26706,

count=8, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=22, id=260, version=27041,

count=41, id=260, version=26706,

count=136, id=261, version=26706,

count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, productName=Unmarked objects (old),

count=658, id=260, version=27038,

count=5, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=689, id=1, productName=Unmarked objects,

count=344, id=261, version=27041,

count=85, id=261, version=27054,

count=7, id=261, version=27051,

count=144, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,