CZK_External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CZK_External.exe
Size 1.4MB
Sample260922-ybvvda1dmd
SHA256 6177a50f3320f43b26c96aa4f1c3b453c3a45c12b310a5606ee69371ab5eddd6
MD5 06e31618f9aae1058cb97b45b79e7aa3
SHA1 561c9a73e6b212246001dc70405c07bed520d26c
SHA512 2f1189949877769b474bd9df5b30d2d7b532d79fea2ed3178dc3cf59fc49791996d8f2b7127ff11f4d4029da713cb49a3b5514bf81f5dad8109c3b11d34fa043
SSDEEP 24576:deNWFVz81QtM4S7YdaPbBSbqy1P2OluviinziIW:deNWFVzh5aPFSnl2OlxinGI
TLSH
T152654B0AE50B83E9CD5AB6B586976A0BF7347821173463E713D6E0441FA739CB2F3A50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CZK_External.exe

File Explorer

CZK_External.exe

.exe 1.4MB

CZK_External.exe

IMPHASH 0d82464c9276757ecf2b508a16113252
SHA256 6177a50f3320f43b26c96aa4f1c3b453c3a45c12b310a5606ee69371ab5eddd6
MD5 06e31618f9aae1058cb97b45b79e7aa3
SHA1 561c9a73e6b212246001dc70405c07bed520d26c
SHA512 2f1189949877769b474bd9df5b30d2d7b532d79fea2ed3178dc3cf59fc49791996d8f2b7127ff11f4d4029da713cb49a3b5514bf81f5dad8109c3b11d34fa043
SSDEEP 24576:deNWFVz81QtM4S7YdaPbBSbqy1P2OluviinziIW:deNWFVzh5aPFSnl2OlxinGI
TLSH
T152654B0AE50B83E9CD5AB6B586976A0BF7347821173463E713D6E0441FA739CB2F3A50
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

971000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

QueryPerformanceCounter GetModuleFileNameA SetPriorityClass SetConsoleTextAttribute GetCurrentProcess GetStdHandle OpenProcess GetTickCount64 GetFileAttributesA K32GetProcessMemoryInfo CloseHandle K32GetModuleBaseNameA FreeConsole LoadLibraryW K32EnumProcesses GetModuleHandleW K32EnumProcessModules IsDebuggerPresent SetUnhandledExceptionFilter GetProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW FreeLibrary Sleep GetFileInformationByHandleEx GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetProcAddress IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte RtlVirtualUnwind RtlLookupFunctionEntry GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA RtlCaptureContext

user32

UnregisterClassW GetSystemMetrics RegisterClassExW ShowWindow SetWindowLongPtrW SetWindowPos DestroyWindow GetWindowLongW CreateWindowExW SetClipboardData DispatchMessageW PeekMessageW MessageBoxA SetLayeredWindowAttributes TranslateMessage FindWindowW mouse_event PostQuitMessage UpdateWindow SendInput DefWindowProcW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos LoadCursorW SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware SetCapture GetClientRect SetCursor GetAsyncKeyState

advapi32

CheckTokenMembership AllocateAndInitializeSid FreeSid

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ

winhttp

WinHttpCloseHandle WinHttpReceiveResponse WinHttpReadData WinHttpOpen WinHttpOpenRequest WinHttpSetOption WinHttpConnect WinHttpSendRequest

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcmp strchr __std_exception_destroy __std_terminate __current_exception __current_exception_context __C_specific_handler memset memcpy __std_exception_copy _CxxThrowException memchr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode ftell __acrt_iob_func fflush fclose _get_stream_buffer_pointers _fseeki64 fsetpos ungetc fseek setvbuf fgetpos __stdio_common_vfprintf __stdio_common_vsprintf_s fputc fwrite _wfopen __stdio_common_vsscanf fread __stdio_common_vsprintf fgetc

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncpy strncmp _stricmp _wcsicmp isalnum isdigit strcmp

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free _callnewh malloc

api-ms-win-crt-convert-l1-1-0

atof strtof strtol

api-ms-win-crt-runtime-l1-1-0

abort _register_thread_local_exe_atexit_callback _initialize_onexit_table _initialize_narrow_environment _c_exit _configure_narrow_argv _register_onexit_function __p___argv __p___argc _exit _errno terminate exit _beginthreadex _initterm_e _invoke_watson _initterm _get_initial_narrow_environment _set_app_type _crt_atexit _cexit _seh_filter_exe

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

powf log fmodf floorf roundf logf ldexp __setusermatherr acosf sinf sqrtf atan2f pow cosf ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func