CoDWaW[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CoDWaW.exe
Size 5.3MB
Sample261014-vnt7tsws2k
SHA256 df7bf2dff145665b350271ba2df7b1989f72895b640484d0e0b682046f2ed1c3
MD5 77e5983b2ce20f9378dbb4520085ca10
SHA1 42768532566474f4e5bad85beb56a06feab846ef
SHA512 5f44a9825168814e368ceb697c86d8ce6d94aed0cfbbc5e5a28d64032932058f700d4d696d28b04f62a455803b1432aa8d245eb3f9f8265c1c9531766f64dead
SSDEEP 98304:SFGGlNcRK4GwaloTHcwoRqOvY3WBugWEtDuB:MGGlNcRCvloT8wnOQ3uW+SB
TLSH
T14C46AD40A6F3C1B2D45935B4709A366BEE3171445F2943E3FBF52948CCE1AE05AFB298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CoDWaW.exe

File Explorer

CoDWaW.exe

.exe 5.3MB

CoDWaW.exe

IMPHASH 6335ab238cad5ccdd76c0e094b72cbef
SHA256 df7bf2dff145665b350271ba2df7b1989f72895b640484d0e0b682046f2ed1c3
MD5 77e5983b2ce20f9378dbb4520085ca10
SHA1 42768532566474f4e5bad85beb56a06feab846ef
SHA512 5f44a9825168814e368ceb697c86d8ce6d94aed0cfbbc5e5a28d64032932058f700d4d696d28b04f62a455803b1432aa8d245eb3f9f8265c1c9531766f64dead
SSDEEP 98304:SFGGlNcRK4GwaloTHcwoRqOvY3WBugWEtDuB:MGGlNcRCvloT8wnOQ3uW+SB
TLSH
T14C46AD40A6F3C1B2D45935B4709A366BEE3171445F2943E3FBF52948CCE1AE05AFB298
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3863318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cod5\cod\cod5\pc\CoDSP_s.pdb

winmm

timeEndPeriod mixerGetNumDevs mixerClose mixerGetLineInfoA mixerOpen mixerGetLineControlsA waveInGetNumDevs mixerSetControlDetails mixerGetControlDetailsA timeGetTime timeBeginPeriod

wsock32

ioctlsocket send WSAGetLastError htons ntohl inet_ntoa connect closesocket WSAStartup socket bind recv gethostbyname sendto setsockopt gethostname recvfrom

faultrep

ReportFault

binkw32

_BinkClose@4 _BinkGetRects@8 _BinkSetMemory@8 _BinkRegisterFrameBuffers@8 _BinkWait@4 _BinkOpen@8 _BinkNextFrame@4 _BinkGetFrameBuffersInfo@8 _BinkSetSoundTrack@8 _BinkControlBackgroundIO@8 _BinkGetRealtime@12 _BinkDoFrame@4 _BinkOpenDirectSound@4 _BinkSetIOSize@4 _BinkSetSoundOnOff@8 _BinkPause@8 _BinkSetVolume@12 _BinkGetError@0 _BinkSetSoundSystem@8

d3d9

D3DPERF_BeginEvent Direct3DCreate9 D3DPERF_EndEvent

d3dx9_37

D3DXCompileShader D3DXGetShaderConstantTable D3DXCreateBuffer D3DXGetShaderInputSemantics D3DXGetShaderOutputSemantics

dsound

ord6 ord11

kernel32

GetLocaleInfoA GetStringTypeW GetStringTypeA GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetEnvironmentVariableW SetEnvironmentVariableA FlushFileBuffers GetTimeZoneInformation SetFilePointer GetFileType SetHandleCount GetConsoleMode GetConsoleCP HeapSize GetStdHandle DeleteCriticalSection HeapCreate HeapDestroy LCMapStringW WideCharToMultiByte LCMapStringA QueryPerformanceFrequency QueryPerformanceCounter CloseHandle SleepEx GetLastError ReadFileEx GetFileSize CreateFileA DebugBreak GetSystemTimeAsFileTime InterlockedExchange SuspendThread ResumeThread CreateThread ResetEvent Sleep CreateEventA GetCurrentProcess SetThreadIdealProcessor WaitForSingleObject GetProcessAffinityMask SetEvent GetCurrentThreadId SetThreadPriority SetThreadAffinityMask RaiseException GetCurrentThread DuplicateHandle SetFileAttributesA GetFileAttributesA SetStdHandle VirtualAlloc LeaveCriticalSection EnterCriticalSection GetModuleFileNameA GetModuleHandleA TryEnterCriticalSection InitializeCriticalSection GetProcAddress SetProcessAffinityMask GetThreadPriority GlobalMemoryStatus CreateProcessA FormatMessageA ReadFile WriteFile GetDriveTypeA SetErrorMode OpenProcess SetUnhandledExceptionFilter GlobalUnlock GetCurrentDirectoryA CreateToolhelp32Snapshot GlobalSize Module32First OutputDebugStringA Module32Next GlobalLock GetVersionExA GetCurrentProcessId DeleteFileA LoadLibraryW MultiByteToWideChar FreeLibrary MulDiv SetPriorityClass SetThreadExecutionState LoadLibraryA SwitchToThread InterlockedIncrement InterlockedDecrement CompareFileTime ReleaseMutex CreateMutexA WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapFree HeapAlloc ExitProcess RtlUnwind MoveFileA TerminateProcess UnhandledExceptionFilter IsDebuggerPresent FileTimeToSystemTime FileTimeToLocalFileTime CreateDirectoryA GetFullPathNameA HeapReAlloc GetCommandLineA GetProcessHeap GetStartupInfoA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError CompareStringA CompareStringW SetEndOfFile InterlockedCompareExchange IsProcessorFeaturePresent RemoveDirectoryA FindClose GetSystemTime SystemTimeToFileTime FindNextFileA VirtualFree VirtualQuery FindFirstFileA

user32

CallWindowProcA LoadImageA UpdateWindow AdjustWindowRect DestroyWindow RegisterClassA MoveWindow CreateWindowExA DefWindowProcA SetWindowPos MapVirtualKeyA GetMessageA CloseClipboard GetMonitorInfoA RegisterWindowMessageA SendMessageA GetClipboardData DispatchMessageA OpenClipboard PeekMessageA RegisterClassExA MonitorFromWindow PostQuitMessage GetSystemMetrics TranslateMessage LoadCursorA SetWindowTextA LoadIconA ShowWindow SetFocus ShowCursor GetForegroundWindow SetCursorPos ClientToScreen GetCursorPos ScreenToClient GetWindowRect PostMessageA GetActiveWindow MessageBoxA GetDC GetWindowTextA SetWindowLongA GetWindowLongA ReleaseDC GetDesktopWindow ChangeDisplaySettingsA EnumThreadWindows MonitorFromPoint EnumDisplayMonitors AdjustWindowRectEx IsWindow CloseWindow

gdi32

CreateSolidBrush CreateFontA GetDeviceCaps SetDeviceGammaRamp

advapi32

RegSetValueExA CryptGenRandom CryptReleaseContext CryptAcquireContextA RegOpenKeyA RegCreateKeyA RegQueryValueExA RegCloseKey

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoTaskMemAlloc CLSIDFromString CoUninitialize CoInitialize CoCreateInstance CoInitializeEx CoTaskMemFree

oleaut32

SysAllocString

xinput1_3

ord2 ord4 ord3

psapi

GetProcessMemoryInfo

ws2_32

ntohs inet_ntoa getsockname select __WSAFDIsSet

ddraw

DirectDrawEnumerateExA DirectDrawCreateEx