CCS Universal EXT[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CCS Universal EXT.exe
Size 1.3MB
Sample260810-thgh4ssdrc
SHA256 e740f5eb5004096c7b37e0e4c8b9637a50990616af06f93415281513ea568f24
MD5 60514ac0b4ebc0cec46b0a8569cd6ce7
SHA1 ca78fde80412ebe4d313d6011fee373d13a18b4c
SHA512 d8697a06f66830f10bea7784b48ab4b5225b538b315a6f29f9ee3ba7574043598362cdc627055d9b282bfaec416342af32eefad04a5463aeffb39f0639b83de9
SSDEEP 24576:pjESGCw4wTKMycEAszzwumicTZTnhgcel/ZSTsqOdrsX06Aq:5N3m1lczwumic1nhMEoqiP6L
TLSH
T15355BE71F1AC61E4D03B907CBD5BAA07E630744513213FD722E44A452FE2EE16BBEA85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CCS Universal EXT.exe

File Explorer

CCS Universal EXT.exe

.exe 1.3MB

CCS Universal EXT.exe

IMPHASH f8eef7ef5fb87cbc7086f3c844f7308d
SHA256 e740f5eb5004096c7b37e0e4c8b9637a50990616af06f93415281513ea568f24
MD5 60514ac0b4ebc0cec46b0a8569cd6ce7
SHA1 ca78fde80412ebe4d313d6011fee373d13a18b4c
SHA512 d8697a06f66830f10bea7784b48ab4b5225b538b315a6f29f9ee3ba7574043598362cdc627055d9b282bfaec416342af32eefad04a5463aeffb39f0639b83de9
SSDEEP 24576:pjESGCw4wTKMycEAszzwumicTZTnhgcel/ZSTsqOdrsX06Aq:5N3m1lczwumic1nhMEoqiP6L
TLSH
T15355BE71F1AC61E4D03B907CBD5BAA07E630744513213FD722E44A452FE2EE16BBEA85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

766016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9Ex

kernel32

GetTempPathA GetTickCount64 GetLastError GetCurrentThread CreateThread SetFileAttributesA Module32FirstW VirtualProtectEx GetThreadContext GetProcAddress ExitProcess ReadProcessMemory GetCurrentProcessId GetModuleHandleW Module32NextW SetThreadContext GetTickCount VirtualQueryEx MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter WriteProcessMemory CreateDirectoryW FindClose FindFirstFileExW GetModuleFileNameA Sleep GetStdHandle GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI CopyFileW MoveFileExW GetFileInformationByHandleEx LocalFree FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetConsoleMode OpenProcess TerminateProcess SetConsoleMode CloseHandle Process32FirstW GetCurrentProcess SetConsoleTitleA Process32NextW CreateToolhelp32Snapshot CreateFileW DeviceIoControl FindNextFileW

user32

GetKeyState ShowWindow RegisterClassExW SendInput GetCursorPos ShowCursor UpdateWindow ScreenToClient ClientToScreen GetClientRect mouse_event LoadCursorW TranslateMessage GetSystemMetrics CreateWindowExW SetWindowPos DefWindowProcW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetLayeredWindowAttributes MessageBoxA SetWindowDisplayAffinity PeekMessageW DispatchMessageW SetCursorPos SetCursor GetForegroundWindow GetAsyncKeyState

advapi32

OpenSCManagerW GetUserNameA DeleteService StartServiceA RegOpenKeyExA OpenServiceA RegQueryValueExA CloseServiceHandle RegCloseKey CreateServiceA

msvcp140

??Bid@locale@std@@QEAA_KXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Thrd_yield _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Throw_C_error@std@@YAXH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Cnd_do_broadcast_at_thread_exit _Thrd_sleep _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join _Mtx_unlock ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

urlmon

URLDownloadToFileA

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy memcmp __std_exception_copy memcpy memmove __std_terminate __C_specific_handler wcsstr strstr __current_exception memset _CxxThrowException __current_exception_context memchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode free realloc malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback system _invalid_parameter_noinfo_noreturn exit _errno _c_exit __p___argv __p___argc _beginthreadex _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsscanf _wfopen fclose _set_fmode fseek ftell _get_stream_buffer_pointers _fseeki64 fread __stdio_common_vsprintf_s fsetpos fgetc ungetc setvbuf fgetpos __stdio_common_vsprintf fputc fwrite __p__commode

api-ms-win-crt-string-l1-1-0

isdigit strnlen strcpy_s tolower strncpy strncmp _wcsicmp strcmp

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-math-l1-1-0

acosf asin asinf atan2f atanf ceilf cos cosf _dclass __setusermatherr pow powf sin sqrtf _fdclass sinf sqrt fmodf ldexp tanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale