Кронос[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Кронос.rar
Size

10.8MB
MD5

838ea749243e1d1bc126762fd32fa21e
SHA1

e1340ca9f2d267024dd7f3ae0fafa2f47575c7c8
SHA256

0d7321ad7fcd108245bd99a2ec6d4b6d335be3d228651034e2d8d460dcb9e835
SHA512

f263aa12e6e23a8bdc7db5aea8d310739f21d4e50e6338f3a2a7d3469f3868750b090113991ee2c6b2fdd6f16ef6c99f607096c42fd89c281020ac947af79fa6
SSDEEP

196608:iZJgY/x4oNSekQoqtqdHoy+8AqEGMDa0MCEvlCDaEN1Q5hiB4So4qN6bhQremoWz:ijx4oNRrtqvATGya0MCoCDaM1Q58q4qh

Score

1^/10

Malware Config

Signatures

Files

Кронос.rar
.rar
_cronos/!run.bat
_cronos/CroBugs.dll
.dll windows x86

8511a9408a1b3a820df01690b0bcf814

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadWritePtr
lstrcpynA
lstrlenA
GetModuleFileNameA
CreateFileA
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
IsBadCodePtr
OutputDebugStringA
FormatMessageA
GetModuleHandleA
GetCurrentProcess
IsBadReadPtr
ReadProcessMemory
GetCurrentThread
GetCurrentDirectoryA
ExitProcess
WriteFile
LocalFree
lstrlenW
OutputDebugStringW
GetThreadContext
SetLastError
GetVersionExA
GetProcAddress
LoadLibraryA
DisableThreadLibraryCalls
VirtualProtect
VirtualQuery
IsBadStringPtrA
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
WaitForSingleObject
IsBadStringPtrW
CreateFileW
OpenProcess
GetCurrentProcessId
HeapAlloc
VirtualQueryEx
GetLastError
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetACP
RtlUnwind
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetCommandLineA
GetVersion
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
HeapSize
TlsAlloc
TlsFree
TlsGetValue
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo

user32

wsprintfA
GetLastActivePopup
GetActiveWindow
wvsprintfA
wvsprintfW
SetLastErrorEx
MessageBoxA

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyA

dbghelp

SymInitialize
SymGetModuleBase
SymLoadModule
SymGetSymFromAddr
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymGetModuleInfo
SymCleanup
StackWalk

Exports

Exports

AddClientDV
AddCrashHandlerLimitModule
AddDiagAssertModule
AllocAndFillProcessModuleList
BSUGetModuleBaseName
BSUGetModuleFileNameEx
BSUSymInitialize
CreateCurrentProcessMiniDumpA
CreateCurrentProcessMiniDumpW
DiagAssertA
DiagAssertVB
DiagAssertW
DiagOutputA
DiagOutputVB
DiagOutputW
GetFaultReason
GetFaultReasonVB
GetFirstStackTraceString
GetFirstStackTraceStringVB
GetLimitModuleCount
GetLimitModulesArray
GetLoadedModules
GetNextStackTraceString
GetNextStackTraceStringVB
GetRegisterString
GetRegisterStringVB
HookImportedFunctionsByName
HookOrdinalExport
IsMiniDumpFunctionAvailable
IsNT
MemStressInitializeA
MemStressInitializeW
MemStressTerminate
SetCrashHandlerFilter
SetDiagAssertFile
SetDiagAssertOptions
SetDiagOutputFile
ValidateAllBlocks

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
_cronos/CroSys.dat
_cronos/CroSys.tad
_cronos/Cronos.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

_Scintilla_DirectFunction@16

Sections

Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832KB - Virtual size: 832KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 492KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mackt
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stolen
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stub
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cronos_old/Cronos_PRO_5.0.11003/CroBugs.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

AddClientDV
AddCrashHandlerLimitModule
AddDiagAssertModule
AllocAndFillProcessModuleList
BSUGetModuleBaseName
BSUGetModuleFileNameEx
BSUSymInitialize
CreateCurrentProcessMiniDumpA
CreateCurrentProcessMiniDumpW
DiagAssertA
DiagAssertVB
DiagAssertW
DiagOutputA
DiagOutputVB
DiagOutputW
GetFaultReason
GetFaultReasonVB
GetFirstStackTraceString
GetFirstStackTraceStringVB
GetLimitModuleCount
GetLimitModulesArray
GetLoadedModules
GetNextStackTraceString
GetNextStackTraceStringVB
GetRegisterString
GetRegisterStringVB
HookImportedFunctionsByName
HookOrdinalExport
IsMiniDumpFunctionAvailable
IsNT
MemStressInitializeA
MemStressInitializeW
MemStressTerminate
SetCrashHandlerFilter
SetDiagAssertFile
SetDiagAssertOptions
SetDiagOutputFile
ValidateAllBlocks

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.NewIT
Size: 4KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cronos_old/Cronos_PRO_5.0.11003/CroPlugs.dll
.dll windows x86

3c881686c2f485de5aa0b87fcb2429b5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperBuffW

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
SignalObjectAndWait
SetEvent
ResetEvent
OutputDebugStringW
MultiByteToWideChar
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcess
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateEventW
CompareStringW
CloseHandle
Sleep

Exports

Exports

Dummy

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 19KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cronos_old/Cronos_PRO_5.0.11003/CroSys.dat
cronos_old/Cronos_PRO_5.0.11003/CroSys.tad
cronos_old/Cronos_PRO_5.0.11003/Cronos.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 4.2MB - Virtual size: 13.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 541KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 115KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 613KB - Virtual size: 836KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cronos_old/Cronos_PRO_5.0.11003/Plugins/CroCrack.dll
.dll windows x86

5aa31ac898dd9944a6da06ff13028efd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
OpenProcessToken
InitializeSecurityDescriptor
GetTokenInformation
GetLengthSid
FreeSid
AllocateAndInitializeSid
GetKernelObjectSecurity

user32

LoadStringW
MessageBoxA
CharNextW
OpenInputDesktop
MessageBoxA
MessageBoxW
LoadStringW
GetUserObjectInformationA
GetThreadDesktop
GetSystemMetrics
CloseDesktop
CharUpperW
CharNextW

kernel32

lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
Sleep
VirtualFree
VirtualAlloc
GetACP
GetSystemInfo
GetTickCount
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
IsValidLocale
GetSystemDefaultUILanguage
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
GetLocaleInfoW
GetLastError
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrlenW
lstrcmpA
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjects
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
Sleep
SetThreadPriority
SetLastError
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReleaseMutex
ReadFile
OutputDebugStringW
OpenProcess
OpenMutexA
OpenFileMappingA
OpenFileMappingW
OpenEventA
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryExA
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
IsValidLocale
IsBadReadPtr
InitializeCriticalSection
GetVersionExA
GetVersionExW
GetVersion
GetThreadLocale
GetThreadContext
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeLibrary
FormatMessageA
FormatMessageW
FindFirstFileW
FindClose
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DuplicateHandle
DeleteFileW
DeleteCriticalSection
CreateMutexA
CreateMutexW
CreateFileMappingA
CreateFileMappingW
CreateFileA
CreateFileW
CreateEventA
CreateEventW
CompareStringW
CloseHandle
Sleep

ntdll

NtQueryInformationFile

Exports

Exports

Dummy

Sections

.text
Size: 346KB - Virtual size: 346KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cronos_old/Cronos_PRO_5.0.11003/Plugins/CroSkype.dll
.dll windows x86

1035f5ce9258614284074796309ef4fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegCloseKey

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
SetWindowsHookExW
MessageBoxW
LoadStringW
GetWindowTextW
GetSystemMetrics
GetClassNameW
GetAsyncKeyState
CharUpperBuffW
CallNextHookEx

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
SignalObjectAndWait
SetEvent
ResetEvent
OutputDebugStringW
MultiByteToWideChar
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFileAttributesW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcess
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindFirstFileW
FindClose
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateProcessW
CreateEventW
CompareStringW
CloseHandle
Sleep

Exports

Exports

Dummy

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 19KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 69B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cronos_old/Cronos_PRO_5.0.11003/crokey

Sharing

General

Malware Config

Signatures

Files

8511a9408a1b3a820df01690b0bcf814

Headers

File Characteristics

Imports

kernel32

user32

advapi32

dbghelp

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 728B

.reloc Size: 8KB - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

Size: 8.0MB - Virtual size: 8.0MB

Size: 1.6MB - Virtual size: 1.6MB

Size: 516KB - Virtual size: 516KB

Size: 4KB - Virtual size: 4KB

.rsrc Size: 832KB - Virtual size: 832KB

Size: 720KB - Virtual size: 720KB

.data Size: 492KB - Virtual size: 492KB

.adata Size: 4KB - Virtual size: 4KB

.mackt Size: 16KB - Virtual size: 16KB

.stolen Size: 268KB - Virtual size: 268KB

.stub Size: 1KB - Virtual size: 128KB

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 728B

.reloc Size: 8KB - Virtual size: 4KB

.NewIT Size: 4KB - Virtual size: 76KB

3c881686c2f485de5aa0b87fcb2429b5

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 72KB

.itext Size: 1024B - Virtual size: 884B

.data Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 19KB

.idata Size: 3KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 69B

.reloc Size: 6KB - Virtual size: 5KB

.rsrc Size: 42KB - Virtual size: 42KB

Headers

File Characteristics

Sections

Size: 4.2MB - Virtual size: 13.2MB

Size: 541KB - Virtual size: 2.4MB

Size: 115KB - Virtual size: 644KB

Size: 24KB - Virtual size: 24KB

.rsrc Size: 1.5MB - Virtual size: 5.7MB

Size: - Virtual size: 1.2MB

Size: 512B - Virtual size: 4KB

.data Size: 613KB - Virtual size: 836KB

.adata Size: - Virtual size: 4KB

5aa31ac898dd9944a6da06ff13028efd

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 728B

.reloc
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 832KB - Virtual size: 832KB

.data
Size: 492KB - Virtual size: 492KB

.adata
Size: 4KB - Virtual size: 4KB

.mackt
Size: 16KB - Virtual size: 16KB

.stolen
Size: 268KB - Virtual size: 268KB

.stub
Size: 1KB - Virtual size: 128KB

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 728B

.reloc
Size: 8KB - Virtual size: 4KB

.NewIT
Size: 4KB - Virtual size: 76KB

.text
Size: 72KB - Virtual size: 72KB

.itext
Size: 1024B - Virtual size: 884B

.data
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 19KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 69B

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 1.5MB - Virtual size: 5.7MB

.data
Size: 613KB - Virtual size: 836KB

.adata
Size: - Virtual size: 4KB

.text
Size: 346KB - Virtual size: 346KB

.itext
Size: 1KB - Virtual size: 1KB

.data
Size: 9KB - Virtual size: 8KB

.bss
Size: - Virtual size: 21KB

.idata
Size: 5KB - Virtual size: 4KB

.didata
Size: 512B - Virtual size: 154B

.edata
Size: 512B - Virtual size: 69B

.reloc
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 12KB - Virtual size: 12KB

.text
Size: 74KB - Virtual size: 74KB

.itext
Size: 1024B - Virtual size: 976B

.data
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 19KB

.idata
Size: 3KB - Virtual size: 3KB

.edata
Size: 512B - Virtual size: 69B

.reloc
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 42KB - Virtual size: 42KB