cpuz[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cpuz.exe
Size 4.3MB
Sample261113-swdtpsc19p
SHA256 4f5a0a99ed68f4590437882ef6c5675d5ff61058cf424eec770037644f28c1be
MD5 888b923e2542f38e872d07e7020a1c75
SHA1 defdbc7d622cc4a181ebb1a102deb85105ad8247
SHA512 a9d06ef86ab4c8e8baca25019bc53b5432066b49e036e89c1c8e54f1d2537736859818bd55a72f92295c5c33569943641787a2fb925c83db2a7facc222be9c09
SSDEEP 98304:891Wtn7lJ4kDOptL2itpHaZF7/mAjkQ9q:891cn7lJ7OpdpHmBjkaq
TLSH
T1BB26CF02F792866ED561A63C8373D393EF723C505B2582CB62916AF89FD32D42E3D650
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cpuz.exe

File Explorer

cpuz.exe

.exe 4.3MB

cpuz.exe

IMPHASH ceb91c7323b37d7236c03afe741e4c95
SHA256 4f5a0a99ed68f4590437882ef6c5675d5ff61058cf424eec770037644f28c1be
MD5 888b923e2542f38e872d07e7020a1c75
SHA1 defdbc7d622cc4a181ebb1a102deb85105ad8247
SHA512 a9d06ef86ab4c8e8baca25019bc53b5432066b49e036e89c1c8e54f1d2537736859818bd55a72f92295c5c33569943641787a2fb925c83db2a7facc222be9c09
SSDEEP 98304:891Wtn7lJ4kDOptL2itpHaZF7/mAjkQ9q:891cn7lJ7OpdpHmBjkaq
TLSH
T1BB26CF02F792866ED561A63C8373D393EF723C505B2582CB62916AF89FD32D42E3D650
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1286800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegEnumValueW RegOpenKeyExW RegCloseKey RegQueryValueExW

dxgi

CreateDXGIFactory1

winmm

timeEndPeriod timeBeginPeriod

kernel32

SetUnhandledExceptionFilter WaitForSingleObject GetModuleHandleA LoadLibraryA CloseHandle GetProcAddress CreateEventA SetWaitableTimer CreateWaitableTimerExW GetLastError GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter SetThreadPriority GetCurrentThread AcquireSRWLockExclusive GetStartupInfoW SleepConditionVariableSRW Sleep GetCurrentThreadId InitializeSListHead FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetCurrentProcessId SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte WakeAllConditionVariable GetSystemTimeAsFileTime LocalFree ReleaseSRWLockExclusive

user32

UpdateWindow RegisterClassExA GetDesktopWindow LoadIconA mouse_event DefWindowProcA GetMonitorInfoA ShowWindow ScreenToClient MonitorFromWindow GetDC ReleaseDC CreateWindowExA LoadCursorA GetKeyNameTextA MapVirtualKeyA GetAsyncKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowRect

gdi32

GetDeviceCaps

shell32

SHGetFolderPathA

msvcp140

?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?uncaught_exceptions@std@@YAHXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_detach ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr __C_specific_handler __std_exception_destroy __std_exception_copy memchr memcmp _CxxThrowException __current_exception_context __current_exception memset memmove memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s fgetc __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite fgetpos fseek fclose fflush __acrt_iob_func ftell ungetc fsetpos _fseeki64 _set_fmode fputc __p__commode setvbuf _get_stream_buffer_pointers

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc _callnewh realloc _set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtoull strtol strtod strtoll atoll strtoul atoi

api-ms-win-crt-runtime-l1-1-0

abort _register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _initialize_narrow_environment _exit exit _initialize_onexit_table _initterm_e _register_onexit_function _crt_atexit _initterm _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _errno _beginthreadex terminate

api-ms-win-crt-math-l1-1-0

fmodf floorf _dsign sqrtf asinf sinf __setusermatherr llroundf ldexp expf cosf remainderf atanf powf tanf acosf _hypotf atan2f ceilf

api-ms-win-crt-string-l1-1-0

strncpy_s _wcsnicmp strncmp strncpy _wcsicmp strcmp toupper _stricmp isxdigit strlen wcslen

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64