Cpp1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Cpp1.exe
Size 113KB
Sample260620-2qmzvsaz71
SHA256 42d653499acc2bac738d81dbfe2d7e70201f5d30b82e5db79d7373284304add0
MD5 741da1cb44286d2a0fee6758e1d2e94e
SHA1 14e4d5f31074b2e874e4e28b5eda102bb672023c
SHA512 ad0946c9fd7b4357d160a82e34a8e0a804df665e62da2a19a668d0301a50cca3e8f7c5bc30943cbbfdb5de010492c9c19cef156954c3241cfa4abcfbf9f5708e
SSDEEP 1536:zA1msU4Kjf8NK5vVcmb7UaC/xoxbpI9Uv4m4DF8TpDoanDkK6zli2:z5ONACe7XNIc4m3BnDkK6x9
TLSH
T16FB33B17FB1940A6D26AC57CCA434806DBB2BC594791A7CB27D01ED60F27BE4AE3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Cpp1.exe

File Explorer

Cpp1.exe

.exe 113KB

Cpp1.exe

IMPHASH a341139e436c7738779b96151caa9d6a
SHA256 42d653499acc2bac738d81dbfe2d7e70201f5d30b82e5db79d7373284304add0
MD5 741da1cb44286d2a0fee6758e1d2e94e
SHA1 14e4d5f31074b2e874e4e28b5eda102bb672023c
SHA512 ad0946c9fd7b4357d160a82e34a8e0a804df665e62da2a19a668d0301a50cca3e8f7c5bc30943cbbfdb5de010492c9c19cef156954c3241cfa4abcfbf9f5708e
SSDEEP 1536:zA1msU4Kjf8NK5vVcmb7UaC/xoxbpI9Uv4m4DF8TpDoanDkK6zli2:z5ONACe7XNIc4m3BnDkK6x9
TLSH
T16FB33B17FB1940A6D26AC57CCA434806DBB2BC594791A7CB27D01ED60F27BE4AE3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MyProjects\Projects\Cpp1\x64\Release\Cpp1.pdb

libcrypto-3-x64

EVP_aes_256_gcm EVP_CIPHER_CTX_new BIO_new EVP_DecryptUpdate BIO_push BIO_f_base64 EVP_DecryptFinal_ex BIO_read BIO_set_flags EVP_DecryptInit_ex BIO_free_all EVP_CIPHER_CTX_ctrl BIO_new_mem_buf EVP_CIPHER_CTX_free

crypt32

CryptUnprotectData

kernel32

IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry IsProcessorFeaturePresent FormatMessageA LocalFree AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW RtlCaptureContext GetLocaleInfoEx

msvcp140

?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Strcoll ?_Syserror_map@std@@YAPEBDH@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception memmove __C_specific_handler memset memcpy memcmp strchr __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

setvbuf fgetpos fwrite fsetpos fread fgetc _fseeki64 fclose fflush _get_stream_buffer_pointers ungetc fputc _set_fmode __p__commode

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode realloc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function __p___argc _initialize_onexit_table exit _initterm_e _initterm __p___argv _initialize_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe _cexit abort _exit _invoke_watson _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _crt_atexit _c_exit

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr