Codex 2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Codex 2.exe
Size 438KB
Sample260814-dmebjstcph
SHA256 a9f7b078e819abbe6b9c34ea943b43bad9e1e25db56894bdb7cee03f522ed7eb
MD5 c8d7e6e414476ed802036b126ad9e6fc
SHA1 ae776cd6faae255eef3c1dc2bdfbb41a35c2d61d
SHA512 aef13ee78022005dc35eaf1649e80ae24b983842f951a1f1c63949a44ce574c748067b7fec6123763f45e0e7209e35f009d86796b5b12addafde641b3b930ff8
SSDEEP 6144:ACSFWgfVcbeIhlT9/PCiC5S09gssSWnh6dMCDUva3mQgaaSPUikgiPnpv8NnR6T:EFY9lxXYWnh6dlDYMgvYiPnZ8NR6T
TLSH
T1F8A4AF85F1E444FCD02B913896ABBA0BEA393418132056DB63D4E5AC2BE37F497F6351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Codex 2.exe

File Explorer

Codex 2.exe

.exe 438KB

Codex 2.exe

IMPHASH 7c88a4e1619ebcd6b42db3b923be22ef
SHA256 a9f7b078e819abbe6b9c34ea943b43bad9e1e25db56894bdb7cee03f522ed7eb
MD5 c8d7e6e414476ed802036b126ad9e6fc
SHA1 ae776cd6faae255eef3c1dc2bdfbb41a35c2d61d
SHA512 aef13ee78022005dc35eaf1649e80ae24b983842f951a1f1c63949a44ce574c748067b7fec6123763f45e0e7209e35f009d86796b5b12addafde641b3b930ff8
SSDEEP 6144:ACSFWgfVcbeIhlT9/PCiC5S09gssSWnh6dMCDUva3mQgaaSPUikgiPnpv8NnR6T:EFY9lxXYWnh6dlDYMgvYiPnZ8NR6T
TLSH
T1F8A4AF85F1E444FCD02B913896ABBA0BEA393418132056DB63D4E5AC2BE37F497F6351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

347968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Maddox\Downloads\CodexFree (2)\x64\Release\Codex.pdb

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

urlmon

URLDownloadToFileW

kernel32

GetLastError Process32NextW LoadLibraryA DeleteFileW Process32FirstW CloseHandle GetProcAddress ExitProcess CreateProcessW lstrcmpiW AllocConsole SetLastError GetTickCount CreateToolhelp32Snapshot MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter InitializeSListHead AcquireSRWLockExclusive ReleaseSRWLockExclusive Sleep OpenProcess GetModuleHandleA CreateFileW DeviceIoControl GetCurrentProcess GetCommandLineW WaitForSingleObject GetStartupInfoW WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime OutputDebugStringA

user32

ScreenToClient ClientToScreen GetKeyboardLayout SetCursor GetClientRect SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId GetWindowRect DestroyWindow GetKeyState SetWindowPos ShowWindow IsWindow GetAsyncKeyState DispatchMessageW PeekMessageW GetForegroundWindow EnumWindows DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconW LoadCursorW GetDesktopWindow SetWindowLongW GetCursorPos RegisterClassExA UpdateWindow GetSystemMetrics

advapi32

OpenProcessToken LookupPrivilegeValueW RevertToSelf PrivilegeCheck SetTokenInformation GetTokenInformation SetThreadToken CreateProcessAsUserW DuplicateTokenEx

shell32

ShellExecuteW

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context memchr memcmp memcpy memmove memset

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

fread __stdio_common_vsprintf _wfopen fwrite fseek fclose __stdio_common_vsscanf __stdio_common_vfprintf __p__commode _set_fmode fflush ftell __acrt_iob_func freopen_s __stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

strcmp _wcsicmp strlen wcslen strncmp strncpy

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e _exit terminate __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table system _initialize_narrow_environment exit _configure_narrow_argv _beginthreadex _crt_atexit

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

cosf sinf powf sqrtf tanf fmodf ceilf logf atan2 acosf asin __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale