caf0cbf8bc9f795c2b5cc116e625839a[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
caf0cbf8bc9f795c2b5cc116e625839a.exe
Size 466KB
Sample261024-yyagyswygx
SHA256 3f1a53d4dd687e581c755d2dd2225266f787fbf8b85660fd898b502aecf35927
MD5 639b204871757af946e213a64d97ade1
SHA1 05edc2514a01fae133ef95d7c019bd6fbc407e42
SHA512 946c5dc34d80d0ee27a927462d1a66019e1b166132a0993e4cdedcf2ae13e4941913c6b09880d99b0c8d0547772dc567eeea8d5ec253e8a393ed615ed3a7613e
SSDEEP 12288:+aKJUbrf/rFy9fffffffWC5VrgBMruO83yQEX5Hh23X:p9yNVWMruO9X5Y3X
TLSH
T17FA47D59E6A400FDD5B7C6B8C9174903EBB278560771AA4F03E0EA721F276624F2FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
caf0cbf8bc9f795c2b5cc116e625839a.exe

File Explorer

caf0cbf8bc9f795c2b5cc116e625839a.exe

.exe 466KB

caf0cbf8bc9f795c2b5cc116e625839a.exe

IMPHASH 99a56c03cec690d907cd5316fcec0386
SHA256 3f1a53d4dd687e581c755d2dd2225266f787fbf8b85660fd898b502aecf35927
MD5 639b204871757af946e213a64d97ade1
SHA1 05edc2514a01fae133ef95d7c019bd6fbc407e42
SHA512 946c5dc34d80d0ee27a927462d1a66019e1b166132a0993e4cdedcf2ae13e4941913c6b09880d99b0c8d0547772dc567eeea8d5ec253e8a393ed615ed3a7613e
SSDEEP 12288:+aKJUbrf/rFy9fffffffWC5VrgBMruO83yQEX5Hh23X:p9yNVWMruO9X5Y3X
TLSH
T17FA47D59E6A400FDD5B7C6B8C9174903EBB278560771AA4F03E0EA721F276624F2FB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

183760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpen WinHttpCrackUrl WinHttpCloseHandle WinHttpReadData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpConnect WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

kernel32

GetProcessHeap HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CreateFileW DeleteFileW FlushFileBuffers GetFileInformationByHandle GetFileSizeEx ReadFile SetFileInformationByHandle SetFilePointerEx CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess CreateProcessW OpenProcess GetTickCount64 FreeLibrary GetModuleFileNameW LoadLibraryExW QueryFullProcessImageNameW CopyFileW MultiByteToWideChar WideCharToMultiByte SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocaleInfoW LCMapStringW CompareStringW SetStdHandle HeapSize WriteConsoleW SetEndOfFile WriteFile AreFileApisANSI LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW CreateFile2 RtlUnwind GetModuleHandleW GetProcAddress MoveFileExW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc VirtualProtect

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

advapi32

RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

Name

mzmwvcus

Size

338KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

pteydudh

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

gpjwzddx

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

nabhgagm

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

imbfnymo

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

zmicidnq

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

ivssfrre

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

caf0cbf8bc9f795c2b5cc116e625839a.exe

winhttp

bcrypt

kernel32

shell32

ole32

advapi32

generic