Static task
static1
Behavioral task
behavioral1
Sample
codsmp.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
codsmp.dll
Resource
win10v2004-20230220-en
General
-
Target
codsmp.zip
-
Size
188KB
-
MD5
0ebebd46e89cf4a0cf876df41dc0befd
-
SHA1
cc583f55bc408b9094a4aeab1773ed1c1ae16b66
-
SHA256
e1d0aef5d33269c476c958fc21932453d0daa53de9cf861ad785d5f8c6e8a40d
-
SHA512
0979d344643ab71547f1895d5976741b91bbcf0e1184d60eefdbb43736320949809c70766eb7cfdbba002dfc1be466276c2b5c865d00e29aec041c46f8a68728
-
SSDEEP
3072:MqpsLiwJ0bVS+ClpHKtqScTYewwWrEs0T9cvccS8YbRaWb5KINUlBQTA5BSTo0Te:M72DNCfcqhTYewwW+iZS8kRaWtT0tR
Malware Config
Signatures
Files
-
codsmp.zip.zip
-
codsmp.asi.dll windows x86
e4843cf3f679d534c52167160feac03e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
K32EnumProcessModules
K32GetModuleInformation
Sleep
SetPriorityClass
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
HeapAlloc
HeapFree
GetProcessHeap
lstrlenA
QueryPerformanceCounter
GetSystemInfo
GetTickCount
CreateThread
SetThreadPriority
WriteProcessMemory
FlushInstructionCache
CreateDirectoryA
WriteFile
GetTempPathA
GetModuleFileNameA
WideCharToMultiByte
GetACP
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
AreFileApisANSI
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindClose
SetCurrentDirectoryW
FormatMessageA
LocalFree
VirtualQuery
GetLocalTime
GetCurrentThread
ExitProcess
InitializeSListHead
GetCurrentProcess
SetUnhandledExceptionFilter
GetProcAddress
GetLastError
CloseHandle
GetModuleHandleExA
CreateFileW
GetCurrentDirectoryA
GetModuleHandleA
VirtualProtect
GetTickCount64
WaitForSingleObject
SetLastError
TerminateThread
CreateFileA
user32
MessageBoxA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowA
SetWindowsHookExA
CallNextHookEx
shell32
ShellExecuteA
SHGetKnownFolderPath
msvcp140
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
dbghelp
SymSetOptions
SymCleanup
SymInitialize
SymFromAddr
StackWalk64
wininet
DeleteUrlCacheEntry
InternetReadFile
InternetOpenA
InternetOpenUrlA
urlmon
URLDownloadToFileA
vcruntime140
__std_type_info_destroy_list
_except_handler4_common
_purecall
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memmove
memset
memchr
strstr
strrchr
__std_type_info_compare
memcpy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_configure_narrow_argv
_cexit
terminate
_seh_filter_dll
_initterm_e
exit
_errno
_invalid_parameter_noinfo_noreturn
_set_invalid_parameter_handler
_wassert
_initterm
api-ms-win-crt-string-l1-1-0
_stricmp
isdigit
isalpha
strncpy
tolower
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
_callnewh
api-ms-win-crt-convert-l1-1-0
strtol
atoi
mbstowcs_s
api-ms-win-crt-stdio-l1-1-0
fread
fseek
fclose
fputc
fflush
fopen
ftell
fwrite
fputs
fopen_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
_get_stream_buffer_pointers
fgetc
ungetc
setvbuf
fgetpos
__stdio_common_vfprintf
_fseeki64
fsetpos
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
remove
_unlock_file
_fullpath
rename
_lock_file
_stat64i32
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
strftime
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
.text Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 10.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
codsmp.ini
-
custom_models/codsmp.txd
-
readme.txt