OCCT[.]exe | Triage™

General

Target
OCCT.exe
Size 212.6MB
Sample260714-sd17aafs8p
SHA256 0203b36b13805abaaa2f24376cf70247022b8c6449a573cb8c0d12ce3c1a3dfb
MD5 3f9e84de3e78feb18e8ec91dd69b66f5
SHA1 329362a2278cb007ad144de03180957c80e4e098
SHA512 4fd654acc1595df8478168823578f25176070d5a43a359e42e094da519986b695752eec2cc470b64f2a981cc1b5198643d2cca17cbdc9a4a0799201c75c07a8b
SSDEEP 6291456:homs+NjrKMXNG4m3qCsjAAWGhmJq+S0yV+dYs8AvTJhou:nLjeuG4m3LyF4q+S0yU8u0u
TLSH
T121B833625D888D85E57BC078E696AA44D4FF3025B2BD98CF4F5E71613B43AE32738708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OCCT.exe

File Explorer

OCCT.exe

.exe 212.6MB

OCCT.exe

IMPHASH c527ed76bc38a5000a2518602bb41e9b
SHA256 0203b36b13805abaaa2f24376cf70247022b8c6449a573cb8c0d12ce3c1a3dfb
MD5 3f9e84de3e78feb18e8ec91dd69b66f5
SHA1 329362a2278cb007ad144de03180957c80e4e098
SHA512 4fd654acc1595df8478168823578f25176070d5a43a359e42e094da519986b695752eec2cc470b64f2a981cc1b5198643d2cca17cbdc9a4a0799201c75c07a8b
SSDEEP 6291456:homs+NjrKMXNG4m3qCsjAAWGhmJq+S0yV+dYs8AvTJhou:nLjeuG4m3LyF4q+S0yU8u0u
TLSH
T121B833625D888D85E57BC078E696AA44D4FF3025B2BD98CF4F5E71613B43AE32738708
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

227352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommandLineW GetStdHandle GetModuleFileNameW OpenProcess K32GetModuleFileNameExA QueryFullProcessImageNameA AllocConsole LoadLibraryW GetProcAddress LocalFree CreateProcessW FreeLibrary WideCharToMultiByte GetExitCodeProcess CloseHandle AttachConsole LCMapStringEx DecodePointer MultiByteToWideChar CreateFileW DeleteFileW FindFirstFileW GetFileAttributesW GetFileAttributesExW SetFileAttributesW MoveFileExW FindClose GetFileType WriteFile GetLastError GetTickCount GetFileSizeEx GetFileTime ReadFile SetFilePointerEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc HeapFree GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW GetTimeZoneInformation HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap HeapSize SetEndOfFile WriteConsoleW FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW CreateDirectoryW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceFrequency Sleep RtlUnwind

shell32

CommandLineToArgvW

bcrypt

BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptDestroyHash BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2 BCryptGenRandom BCryptEncrypt

advapi32

GetSecurityInfo

Name

.text

Size

416KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OCCT.exe

kernel32

shell32

bcrypt

advapi32

generic