CCS Universal EXT[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CCS Universal EXT.exe
Size 741KB
Sample260720-qrfrdsby2j
SHA256 8a773f0e5f508c2e862446e253e547d9991e3f057c155faec047d892bff5117c
MD5 386d99d761cbca66085c215b0df95482
SHA1 1c5335a3e145ccac8a5fc360549669a1148ec471
SHA512 602072179dc2712841f001b4160ccd809eefef1df3f165d382ebb971af29d8875fe88c28b786155fac4f729fa745e8a7a5018a87e03c20ed30356ae3d80234f1
SSDEEP 12288:OX+5a75kmn+O89VtIUQQzCP8/ZTWyIgHx5JA0F5OnMmS/HnLI:OX+585kmn+19nIUlz/TbRTA0F5OnNS/k
TLSH
T15DF46D36E19D25E4D076D038FD8BAD07E571B40513306FE722A40A446FE7EE217BEA92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CCS Universal EXT.exe

File Explorer

CCS Universal EXT.exe

.exe 741KB

CCS Universal EXT.exe

IMPHASH 605b062b0236a672f0d952af80ab0277
SHA256 8a773f0e5f508c2e862446e253e547d9991e3f057c155faec047d892bff5117c
MD5 386d99d761cbca66085c215b0df95482
SHA1 1c5335a3e145ccac8a5fc360549669a1148ec471
SHA512 602072179dc2712841f001b4160ccd809eefef1df3f165d382ebb971af29d8875fe88c28b786155fac4f729fa745e8a7a5018a87e03c20ed30356ae3d80234f1
SSDEEP 12288:OX+5a75kmn+O89VtIUQQzCP8/ZTWyIgHx5JA0F5OnMmS/HnLI:OX+585kmn+19nIUlz/TbRTA0F5OnNS/k
TLSH
T15DF46D36E19D25E4D076D038FD8BAD07E571B40513306FE722A40A446FE7EE217BEA92
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

632576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9Ex

kernel32

GetTickCount64 GetLastError CreateThread SetFileAttributesA GetCurrentProcessId GetModuleHandleW GetTickCount IsDebuggerPresent MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress QueryPerformanceCounter CloseHandle CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle Process32FirstW GetConsoleMode SetConsoleTitleA SetFileInformationByHandle AreFileApisANSI CopyFileW MoveFileExW GetFileInformationByHandleEx LocalFree FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetTempPathA Sleep SetConsoleMode GetStdHandle Process32NextW CreateToolhelp32Snapshot CreateFileW GetModuleFileNameA DeviceIoControl

user32

GetKeyState RegisterClassExW GetAsyncKeyState DispatchMessageW SendInput GetCursorPos ShowCursor ScreenToClient ClientToScreen UpdateWindow mouse_event LoadCursorW TranslateMessage GetSystemMetrics CreateWindowExW MessageBoxW SetWindowPos DefWindowProcW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetLayeredWindowAttributes MessageBoxA SetWindowDisplayAffinity PeekMessageW ShowWindow SetCursorPos GetForegroundWindow SetCursor GetClientRect

advapi32

StartServiceA OpenServiceA GetUserNameA OpenSCManagerW CloseServiceHandle CreateServiceA DeleteService

msvcp140

??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Thrd_yield _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Throw_C_error@std@@YAXH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Cnd_do_broadcast_at_thread_exit _Thrd_sleep _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join _Mtx_unlock ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

urlmon

URLDownloadToFileA

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy memchr memcmp memcpy __std_exception_copy __std_terminate memmove memset _CxxThrowException __current_exception_context __current_exception strstr wcsstr

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-runtime-l1-1-0

exit terminate _beginthreadex _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _configure_narrow_argv _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment system

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsscanf _wfopen fclose __p__commode fseek ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite __stdio_common_vsprintf_s fputc _set_fmode fgetc

api-ms-win-crt-string-l1-1-0

strcpy_s tolower strncpy strncmp _wcsicmp strcmp

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

acosf asin asinf atan2f atanf ceilf __setusermatherr fmodf pow powf sqrtf _fdclass sin cosf sinf sqrt tanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale