CodeForge[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CodeForge.exe
Size

169KB
MD5

46e6fa1793561b4dda0a1848550aab93
SHA1

7288fba570fbba7576ed21db79241dcbc969392c
SHA256

2cdb78330f90b9fb20b8fb1ef9179e2d9edfbbd144d522f541083b08f84cc456
SHA512

9dd9997066f282f13d7230d0568a96a23e0277e1c4ef28722914082bf176036c2ed004a452cf9a0772a0cb19c98c19545911ccaf0d78aeb8cae4e3e08f5da290
SSDEEP

1536:STuc2VIqr9pdbkfT9sWWp0zbGSR3I2a+yg+R96yl14bfnKLVS+j9gIHkkxF/1zNh:/cOr9pdG+wG2q9n4bvcS+FxF/1zNNFZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CodeForge.exe

Files

CodeForge.exe
.exe windows:6 windows x64 arch:x64

46c994a122dcd281747de6710a61343f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetTempPathW
GetLocalTime

Sections

.text
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ