CodeineCC[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CodeineCC.exe
Size 1.1MB
Sample260628-zh79qaew4j
SHA256 e06fa72a497e6b5abbc6f1fb1b5df380d5a1203841a7eb205578745a38ff65cd
MD5 7997ca08de3415a2fd997d0a4c9bdb16
SHA1 3ce4350a3f07914072ed39aac7eeccb80d2bb383
SHA512 fb0e9748478c1ed39f589e75674796b48b938217d724f211c64210fef0d142bfe06b0258b77f9072bca606698392b93da9a6d62f8aed87c2651196124e948b52
SSDEEP 24576:5juiifo7AnqUeixCS12Sf2uvhFWRbJrj+5yiEnPqrESdh+YW2ntdzAR0b:5jXwo7AWGraIrEnPC5h+z2nttY
TLSH
T16A35AE05F7F449A8C17B9138D5E2EB1BEB36784D07209ADB63E006553FA76E04E76322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CodeineCC.exe

File Explorer

CodeineCC.exe

.exe 1.1MB

CodeineCC.exe

IMPHASH 28cf98e0cebd469a55eafa1da841b3e5
SHA256 e06fa72a497e6b5abbc6f1fb1b5df380d5a1203841a7eb205578745a38ff65cd
MD5 7997ca08de3415a2fd997d0a4c9bdb16
SHA1 3ce4350a3f07914072ed39aac7eeccb80d2bb383
SHA512 fb0e9748478c1ed39f589e75674796b48b938217d724f211c64210fef0d142bfe06b0258b77f9072bca606698392b93da9a6d62f8aed87c2651196124e948b52
SSDEEP 24576:5juiifo7AnqUeixCS12Sf2uvhFWRbJrj+5yiEnPqrESdh+YW2ntdzAR0b:5jXwo7AWGraIrEnPC5h+z2nttY
TLSH
T16A35AE05F7F449A8C17B9138D5E2EB1BEB36784D07209ADB63E006553FA76E04E76322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

664536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

kernel32

Process32First GetFileAttributesExA SetConsoleTextAttribute SetConsoleTitleA FindNextFileW GetStdHandle DeviceIoControl GetModuleFileNameW FindClose WaitForSingleObject CreateFileW GetModuleHandleA CreateToolhelp32Snapshot Sleep CopyFileA GetLastError GetFileAttributesA Process32Next CloseHandle WideCharToMultiByte lstrcmpiA CreateProcessA GetExitCodeProcess MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetLocaleInfoEx FormatMessageA FindFirstFileW GetFileAttributesExW CreateDirectoryW LocalFree

user32

SetLayeredWindowAttributes ShowWindow TranslateMessage mouse_event GetKeyState GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent SetWindowLongA GetSystemMetrics SetWindowPos LoadCursorA GetWindowRect DispatchMessageA SetClipboardData ClientToScreen GetClientRect GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos ReleaseCapture MessageBoxA IsWindowUnicode CreateWindowExA SetCursor GetCursorPos UpdateWindow RegisterClassExA FindWindowA SetWindowLongPtrA SetCapture GetWindowLongPtrA PeekMessageA GetForegroundWindow GetKeyboardLayout DefWindowProcA GetAsyncKeyState

shell32

ShellExecuteA

ole32

CoInitialize

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate strstr strchr memcmp _CxxThrowException __current_exception_context __current_exception memset memmove memchr memcpy

api-ms-win-crt-stdio-l1-1-0

fflush fclose _set_fmode fseek __stdio_common_vsscanf _wfopen __stdio_common_vsprintf_s fgetc __stdio_common_vfprintf __acrt_iob_func _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fputc fwrite ftell __p__commode

api-ms-win-crt-heap-l1-1-0

free _callnewh realloc malloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strcmp strncpy tolower strncmp toupper strncpy_s

api-ms-win-crt-math-l1-1-0

_dclass _fdclass acosf asin _dsign atan2 atan2f __setusermatherr powf sin sinf sqrt sqrtf tan ldexp ceilf cosf tanf fmodf

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _errno system _initialize_onexit_table _beginthreadex _c_exit __p___argv __p___argc abort _invoke_watson _configure_narrow_argv _initialize_narrow_environment _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function terminate

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtod strtoull

api-ms-win-crt-filesystem-l1-1-0

remove _lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

srand rand qsort