Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
Crypter.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Crypter.exe
Resource
win10v2004-20230621-en
General
-
Target
Crypter.exe
-
Size
141KB
-
MD5
26156564a104eae0cc9b06306a63ed9a
-
SHA1
a81e06b82d233c813b8803ce1c608b83cbbba8e6
-
SHA256
f1bb5ce204bc9e9fd12c3cb8c376e36e9ab47528c7c1ca865b38b8bd02314fc9
-
SHA512
f5d502ded9705a7dc53243d9dfae2095f95fbbc288a737f2d4259caa8a6ecbc6b256d786fae042d12af4931b79033540ef0aee98fc6a5ed99539fc7a122b7c98
-
SSDEEP
3072:4qHmFIAcneRB2ukEtRJ2XgqNjjCvvkfV7mF:JmsexkEt2hWCm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Crypter.exe
Files
-
Crypter.exe.exe windows x86
f36535bc80b52993a533783e0bedb4b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
SetProcessShutdownParameters
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Sleep
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindFirstVolumeW
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
GetQueuedCompletionStatus
lstrlenA
DeleteCriticalSection
PostQueuedCompletionStatus
SetFileAttributesW
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetVolumeMountPointW
LocalFree
MoveFileExW
FindVolumeClose
GetCurrentProcessId
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
CreateIoCompletionPort
GetDriveTypeW
GetConsoleWindow
HeapCreate
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
WriteConsoleW
DecodePointer
FlushFileBuffers
GetLocalTime
CloseHandle
lstrcatW
CreateFileW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
WriteFile
EnterCriticalSection
GetCommandLineW
lstrcmpiW
lstrcpyW
lstrlenW
FindClose
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
SetStdHandle
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetACP
GetStringTypeW
GetFileType
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
RaiseException
user32
wsprintfA
wsprintfW
ShowWindow
advapi32
FreeSid
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shell32
CommandLineToArgvW
ShellExecuteW
SHEmptyRecycleBinW
rstrtmgr
RmGetList
RmStartSession
RmEndSession
RmRegisterResources
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ