CCP7[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

CCP7.exe
Size

5.3MB
MD5

fb2a33a4ae17196f8f42208bf12a733e
SHA1

5be80a5b74f72ea4e1f16409e31f799996e318d2
SHA256

8abf3eba7aff1d0423c31485d9801c07f156ef6f132a4af8621436891a9797b7
SHA512

8595998132bbce2eb1ec269d2fe71b498d6d3d941882906412f2f55761a827eea3c8b4b41deea04fe239db0276ff68a0e2f5e80cc74dc3170a305cdfaa4c1ca9
SSDEEP

49152:YaA97M6qivoA1W4xMGgObhSau0SK3yL4OneqxqhQDzH459BKQ1LriDTGtObnwV6p:m1/l1EyOnlzDyk5sV6WXNX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CCP7.exe

Files

CCP7.exe
.exe windows:6 windows x64

80868b6f6d3204b2e3723eb9b06fe534

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

IsDebuggerPresent
SetConsoleScreenBufferSize
CreateFileW
GetLargestConsoleWindowSize
SetConsoleWindowInfo
GetConsoleScreenBufferInfo
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
SetConsoleCursorPosition
lstrlenW
GetProcAddress
SetConsoleMode
GetModuleHandleA
GetSystemInfo
GetFileInformationByHandleEx
GetConsoleMode
GetStdHandle
ReleaseMutex
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SetLastError
RtlVirtualUnwind
GetEnvironmentVariableW
SetFilePointerEx
SetConsoleTitleW
GetCurrentProcess
RtlCaptureContext
RtlLookupFunctionEntry
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
FindClose
GetFinalPathNameByHandleW
UnhandledExceptionFilter
WaitForSingleObject
SetUnhandledExceptionFilter
SetHandleInformation
GetModuleHandleW
FormatMessageW
GetFullPathNameW
QueryPerformanceCounter
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetSystemTimeAsFileTime
PostQueuedCompletionStatus
QueryPerformanceFrequency
InitializeSListHead
GetCurrentThreadId
AcquireSRWLockExclusive
CreateIoCompletionPort
CloseHandle
SetFileCompletionNotificationModes
GetLastError
GlobalMemoryStatusEx
Sleep
GetCurrentDirectoryW
GetQueuedCompletionStatusEx
SwitchToThread
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent

bcrypt

BCryptGenRandom

crypt32

CertVerifyCertificateChainPolicy
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain

ws2_32

WSASend
WSAStartup
recv
shutdown
connect
WSAIoctl
socket
getsockname
WSACleanup
closesocket
getpeername
setsockopt
bind
ioctlsocket
WSASocketW
freeaddrinfo
send
WSAGetLastError
getsockopt
getaddrinfo

shell32

SHCreateItemFromParsingName
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeEx

ntdll

NtReadFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtCreateFile
NtWriteFile
NtDeviceIoControlFile

secur32

InitializeSecurityContextW
ApplyControlToken
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
DecryptMessage
QueryContextAttributesW
FreeContextBuffer
AcceptSecurityContext
EncryptMessage

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SystemFunction036

pdh

PdhCloseQuery
PdhGetFormattedCounterArrayA
PdhOpenQueryA
PdhCollectQueryData
PdhAddEnglishCounterA

vcruntime140

memcpy
__current_exception_context
__CxxFrameHandler3
memset
memcmp
memmove
_CxxThrowException
__C_specific_handler
__current_exception

api-ms-win-crt-string-l1-1-0

strlen
wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
_c_exit
_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_configure_narrow_argv
_set_app_type
terminate
_seh_filter_exe
exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80868b6f6d3204b2e3723eb9b06fe534

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

bcrypt

crypt32

ws2_32

shell32

ole32

ntdll

secur32

advapi32

pdh

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 10KB - Virtual size: 10KB

.pdata Size: 134KB - Virtual size: 134KB

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 10KB - Virtual size: 10KB

.pdata
Size: 134KB - Virtual size: 134KB

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 35KB - Virtual size: 35KB