CodeGen[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CodeGen.exe
Size

1.6MB
MD5

ab0197533274533133dafb4f39b4e6d3
SHA1

27fa0a82894addbdf7ddb6f02f2523b2f4e9db3b
SHA256

dfe4d5fbf3201c132fb195775a50cfb31e2df34fb7dd9dbbb5d9055c6d65b253
SHA512

b56b14247c52490cadd42cf70a1a6cd4ff20c8a43d55b236345cf0370a7d1613d33212af9deda94e012dc4647902936ded7eae2f983196522e7daac292dd1d45
SSDEEP

49152:luw1N16CRwHybQHuaIkRmHnn/eNO93+xn:X609kR8WMuR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CodeGen.exe

Files

CodeGen.exe
.exe windows:6 windows x64 arch:x64

7c4493eb1ae9a1458cc738a2fb7ed6d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

ole32

CoInitialize
CoUninitialize

kernel32

CreateProcessA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
CreateToolhelp32Snapshot
VirtualAllocEx
GetModuleHandleW
Process32First
WriteFile
GetTempPathW
Sleep
DeleteFileW
Process32Next
CreateThread
GetWindowsDirectoryW
CreateProcessW
GetTempFileNameW
Thread32Next
Thread32First
SuspendThread
ResumeThread
OpenProcess
GetThreadContext
SetThreadContext
OpenThread
VirtualProtectEx
GetCurrentProcessId
GetCurrentThread
SetLastError
GetSystemInfo
VirtualFree
VirtualAlloc
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
DeleteCriticalSection
HeapSize
HeapReAlloc
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
HeapFree
HeapAlloc
GetStdHandle
GetModuleFileNameW
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
InterlockedPushEntrySList
RtlUnwindEx
RaiseException
OutputDebugStringW
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
GetLogicalDriveStringsA
CreateFileA
GetLastError
WaitForSingleObject
InitializeCriticalSectionEx
CreatePipe
GetCurrentProcess
SetHandleInformation
ReadFile
IsDebuggerPresent
RtlUnwind
DebugBreak
CloseHandle
CreateFileW
DeviceIoControl
FreeEnvironmentStringsW
InitializeSListHead
GetCPInfo
GetProcessHeap
SetStdHandle
WriteConsoleW
GetStringTypeW
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
SetEndOfFile
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree

user32

SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
ReleaseDC
GetClientRect
UnregisterClassA
SetCursor
SetCapture
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
CreateWindowExA
DefWindowProcA
SetCursorPos
IsIconic
SetForegroundWindow
ReleaseCapture
SetWindowLongW
GetDC
GetForegroundWindow
FindWindowA
DispatchMessageA
GetWindowRect
MessageBoxW
GetAsyncKeyState
MessageBoxA
TranslateMessage
PeekMessageA
PostQuitMessage
GetDesktopWindow
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
LoadCursorA
DestroyWindow
GetMonitorInfoA
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
RegisterClassExA

gdi32

GetDeviceCaps

advapi32

RegQueryValueExW
GetTokenInformation
RegOpenKeyExA
OpenProcessToken
IsValidSid
RegQueryValueExA
ConvertSidToStringSidA
RegCloseKey
RegOpenKeyExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

winhttp

WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse

urlmon

URLOpenBlockingStreamW
URLOpenBlockingStreamA

ntdll

ZwRaiseHardError
NtRaiseHardError
RtlAdjustPrivilege
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 908KB - Virtual size: 908KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 333KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c4493eb1ae9a1458cc738a2fb7ed6d0

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dx11_43

d3dcompiler_43

ole32

kernel32

user32

gdi32

advapi32

shell32

imm32

winhttp

urlmon

ntdll

iphlpapi

Sections

.text Size: 908KB - Virtual size: 908KB

.rdata Size: 323KB - Virtual size: 323KB

.data Size: 333KB - Virtual size: 351KB

.pdata Size: 35KB - Virtual size: 35KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 908KB - Virtual size: 908KB

.rdata
Size: 323KB - Virtual size: 323KB

.data
Size: 333KB - Virtual size: 351KB

.pdata
Size: 35KB - Virtual size: 35KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 6KB - Virtual size: 6KB