�ZIQ^ /��$��w���)���h������lɷ���M�F'�����0zȺ`��0����^����EϿR�3�����3Z����.5��%�E��{'،�bJ��FZ�>j�+uK�-� �� d ��A�*��{��6����P�9�U58|cF�\5������1^+�B�7���lʭ�}��L�ڵ5�f�8�h�?�4 ��h�+v}�%�����%'��}�a��q�>�9UluwU�����[?�������Ed�n���`>f��}���ޕ����'�آ��I)Xل h������C��>����Um�&X�{�0>-[���4� ʽ�������&�P|CJ*T��u�ֳ�]B���)${�+�o2b8J��(��_2���3�N��Ќ� <�ΈT����;��7{+��Z:�װ.(��8|�ME� � ��fI�*���o�_���?33� ��d��p\5�1�zl�n���U���"ԏ8�!�(�qI��x��DyG� ~m�]�"���9���_t�#�:S��_��E�9�\u� ��G��Dr�}�*�g����,�h[4�[j��cH�-K�".dC�(5Y�(PΒ�!�k*hW�Oum���牦�٠_���>�N=�q�i�'�Q���{M�4���� �f��Ihbݎ��_e�L��f|�&P�Ǔ$i�'e�s�A����"������/���.Ws� �����)���$��Y5[���zI��'1��A�\Ҡ�Q;���O=s�8DTht�6�{��dž���A����х���GP���¿�y1�P�]��<9x�ỡ6�w,��R]l��h W���~��B�Y��vZ2�N+�Q�P.A��d���o�B�>ڭ�O�r1C�"��k���"��Z�y3�����F[�������>.��m��'@����eI��W{�����''�}�wo�8Χ:��>{�vV�k��_*z9?����`�\�r��տ�ci���HM������^��M*��|�R�e����UҨ�k &�d��[Q:�el惡kګ�q���8 <��̦������E�L�����k�f�==[�+D�n�p��46������Y�6�bA[�a�)/��}��xW'��!J:��{<���ѵ0RZ�j�������HT��BL �G�訛m���U|��%y^7��.�9X�(�F�aE3'A��d�m#�p(��Y���z��<�TUy ����ZT�iI� R� �窀�K��L_8�Ii�+1�O�M����׃Lr�ҳ^~aʃ�$K���C�Z:�x3�R��[�.Vk�R+� D���^� �-���>�>^q@�\��@�uSY6�˨\��I�f����cM����/l *�u2�\ ��l�>���ɐ�|�0�-�<C�dm�#n�"�;�U�b x��P|�<�#��.Y�(�"�nieT�������#�����A�%ޝ�g<=�`�6������?w�ҿ�Y�-c�K�e�~�����A�]}!��y}�KZE��f���Q�U ���M]U��'�����ō�|&������oFz����̅ ��/6! ������+(�WE�'�1�� i��Bxٴ��N�+-Q#�� �2�~��K��˥g� �d,�MڬƇ���B�Zq� ��nq����1� �j�����s�<�Rc�+����f��-R���cG�~r\ٽа;�g6���}{���W �}�+�&k�>U��!��5��W*����"p����K�����oᄏ��AXK�ӡ6 ыU����؇� �%�Ւr��nL�C��]�nbN�%��Z�����-B�� �S(N?xF�V]���~qI%6q�l~�Inyێ�nFUx�BNs��0���E}��'BN�S�Ľ��n�CjU�~�'��вq#1�?���aUk�4��41w����� (�q������_�B�/�yo2ˢ .��E�烳)2�����AA`���2$j�ȳ=�h'k4�+�^�Ӆ%�����H9��U"!�_0����ɓ�(=��Bn��������J��0��M^��!�vOiR����'�EQ*e�����C~��������(.L:A����W9��D��~צȣ�T`�5]�Rţ�/d�Ɲ�c�f�E'��8Ŗ��WC�`ݥ�����MJ"g7�AS�dm�W(h�~�P� 4��*��,g�h�Cz���n�x9$���<�:$�H�p״��X����������A�VC��Znm�M��w������-�i ��+�] S�]�%�j{)?.o����J����� �#�):H��m)1�A�)�}2�_(��"��s���~��t$5F�2��@�F�-QQ�s����S�(�yI֩4&�Zױk�#��(p(���c�%�Q� �����)G�<�A���۰�xTϔ�y� a��"6m��5�piңo���3�����V�r�)��c�vEX ~�h�n�=�o��ْrd���,�Ls��� �f*,��G�&�JR��zR���⪗��J��wQZ(�Pv��N��2�<t��a����{���Tl�2q�˽�/��#�>�p�Kr��j��N����h�Է �:ڹ�vL4G��U�kӴC��y��4ՂVs�*�N��MWS7���5��h��;��S�����7'�SC� �R��Ͻ������ud��4���)��|�Z羞�j�0����G@tiB�뱮 x� }��{�"t:� <S���@��O(���Ev� ��� �@`�bd���v9�"u��|��������v]��ɮ� ��A�ɨ�������Ltz��+���Z����3d�0���"ƔAn'g(VGJ5t�%���:��l��UF���0�\��KN���$��\V؋��T�Z�5����J~�r>�CR#���j������aG-t0�`v�m��<Ũ�d"�]jp�3P�,�����5K�=h��:к���(>�Y��|3��^Ӡ�n�ЉyIp�$�~�B�!;s�$$Ep!��cX e|��),7��,�:�'����p7���$�\HT$�s�"��gG&UÝ�I��,b}ޅ;?�C@(=
Static task
static1
Behavioral task
behavioral1
Sample
cracked_rust.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cracked_rust.rar
Resource
win10v2004-20220812-en
General
-
Target
cracked_rust.rar
-
Size
14.7MB
-
MD5
b4b6578b75b42f63bf8e23de28f0d0ce
-
SHA1
39c75af0a00d533431c92d45a74292b06ce17b8a
-
SHA256
d7c9b052f9734b5656386ed8edc79beafc7dc29ebd8483de43248f7a48e1cbb0
-
SHA512
081de4f8cd33a9d4d93216d12c946c2da7c8ccc029d2b73eff607303dea09e9ab7e5e0f7f82da7f585232fd1306e96d40c8cafc3ff9e26f6f4898de50c8ae330
-
SSDEEP
393216:YY074Ob7MyxB/4K0msl12ROrw5dXyA42vaxz3yRMhSu:70EOb7MyxB/4K0YuwzXyABkWRMh1
Malware Config
Signatures
Files
-
cracked_rust.rar.rar
-
cracked_rust.exe.exe windows x64
08e6a0cf6686c4d65007f922aa3e7ad2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapDestroy
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClientRect
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
imm32
ImmSetCompositionWindow
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
urlmon
URLDownloadToFileA
d3d9
Direct3DCreate9
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
fmodf
ws2_32
gethostname
wldap32
ord143
crypt32
CertCloseStore
normaliz
IdnToAscii
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 628KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CVV0 Size: - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CVV1 Size: 15.1MB - Virtual size: 15.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ