CSX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CSX.exe
Size 4.1MB
Sample260903-w6sbmabb39
SHA256 acbbb1b19e0fd177f1468449b50e09adf22760726d931759e84a7c3fd949c523
MD5 083c4145b904022cc7f37368d9aef7db
SHA1 93fc8064f5d8c432afe35cffd85d1c7d5e5ee7f8
SHA512 abb98ce3e3de96f12b9ab5c84161b2fba121bf0f4aae4c37ce6e278f29674d419a83c5f15642f9762d6c4741288be080ed563f61e411b9b3249d709ab2a1367d
SSDEEP 98304:sN22cVY5y9ByMlomk6opyNwIrqJtLFNv5sfjap:Y22cdByMk7pyNwIrutr5Aup
TLSH
T15A1601117F719C38CD4671760D288FE7A61DAC313F9F52C63A486B9298224FF61F4A62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CSX.exe

File Explorer

CSX.exe

.exe 4.1MB

CSX.exe

IMPHASH 54946063a5f8548a1ef0a20cff3149a5
SHA256 acbbb1b19e0fd177f1468449b50e09adf22760726d931759e84a7c3fd949c523
MD5 083c4145b904022cc7f37368d9aef7db
SHA1 93fc8064f5d8c432afe35cffd85d1c7d5e5ee7f8
SHA512 abb98ce3e3de96f12b9ab5c84161b2fba121bf0f4aae4c37ce6e278f29674d419a83c5f15642f9762d6c4741288be080ed563f61e411b9b3249d709ab2a1367d
SSDEEP 98304:sN22cVY5y9ByMlomk6opyNwIrqJtLFNv5sfjap:Y22cdByMk7pyNwIrutr5Aup
TLSH
T15A1601117F719C38CD4671760D288FE7A61DAC313F9F52C63A486B9298224FF61F4A62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumKeyExA RegQueryValueExW CredDeleteW GetUserNameW RegOpenKeyExW RegOpenKeyExA RegSetValueExA GetUserNameA RegDeleteKeyA RegCloseKey

gdi32

CreateSolidBrush DeleteObject SetBkColor SetTextColor DeleteDC CreateRoundRectRgn CreateFontW CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt

user32

AppendMenuW GetClientRect SetClipboardData SetCapture LoadCursorW LoadIconW TranslateMessage DestroyMenu EnumWindows TrackMouseEvent RegisterClassW EmptyClipboard CloseClipboard ClientToScreen DispatchMessageW GetCapture OpenClipboard ShowWindow TrackPopupMenu PostQuitMessage SetWindowTextW SendMessageW ScreenToClient GetWindowTextW CreateWindowExW SetWindowRgn MessageBoxW SetWindowPos IsWindowVisible GetDC DestroyWindow GetWindow PostMessageW DefWindowProcW GetMessageW InvalidateRect IsIconic ReleaseDC BeginPaint ReleaseCapture SystemParametersInfoW PtInRect UpdateWindow CreatePopupMenu EndPaint

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

ole32

CoSetProxyBlanket CoInitializeEx CreateStreamOnHGlobal CoCreateInstance CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear

kernel32

DecodePointer HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetFilePointerEx LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlUnwind InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable CreateDirectoryW ReadFile SizeofResource GetFileSizeEx WriteProcessMemory FindFirstFileA SetLastError GetCurrentProcess WriteFile ExpandEnvironmentStringsW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW FindNextFileA SetFilePointer GetEnvironmentVariableW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW ResumeThread OpenProcess SetFileAttributesW CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar GetExitCodeThread Sleep FormatMessageW GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread LoadLibraryA LockResource DeleteFileA GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle CreateThread LoadResource FindResourceW Module32FirstW GetProcAddress GlobalLock VirtualAllocEx MoveFileExW RemoveDirectoryA ExitProcess GetComputerNameW GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte CreateRemoteThread Module32NextW VirtualFreeEx GetTickCount GlobalUnlock GetDriveTypeW IsDebuggerPresent CheckRemoteDebuggerPresent GetSystemTimeAsFileTime InitializeCriticalSectionEx QueryPerformanceCounter GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive WriteConsoleW

shell32

ShellExecuteW SHGetFolderPathW SHFileOperationW SHGetFolderPathA

gdiplus

GdipFillRectangleI GdipDeleteGraphics GdipDrawString GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipDrawPath GdipSetClipRegion GdipFree GdipCreatePen1 GdipGetGenericFontFamilySansSerif GdipSetStringFormatAlign GdipLoadImageFromStream GdipDeleteRegion GdipCloneBrush GdipSetTextRenderingHint GdipGetClip GdipSetPenEndCap GdipFillEllipse GdipFillEllipseI GdipCreateFromHDC GdipClosePathFigure GdipFillRectangle GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipDrawRectangleI GdipResetClip GdipAddPathArcI GdipCreateFontFamilyFromName GdipCloneImage GdipSetPenStartCap GdipDeleteBrush GdipAlloc GdipDrawImageRectI GdipDeletePath GdipDisposeImage GdipSetSmoothingMode GdipSetClipPath GdipCreatePath GdipSetStringFormatLineAlign GdipFillPolygon GdipCreateLineBrushFromRectI GdipCreateFont GdipSetLinePresetBlend GdipSetInterpolationMode GdipCreateSolidFill GdipSetStringFormatTrimming GdipCreateRegion GdipFillPath GdipDrawLine

netapi32

NetApiBufferFree NetShareEnum

Name

.text

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.mmap

Size

1024B

Virtual Size

581B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CSX.exe

advapi32

gdi32

user32

winhttp

ole32

oleaut32

kernel32

shell32

gdiplus

netapi32

generic