CryptFlr[.]exe | Triage

Sharing

General

Target

CryptFlr.exe
Size

224KB
MD5

6df222c6fdd6d1c699f06bc7fd1500e9
SHA1

befad8eb8c42be8dfab04edd67c3ecf45d7df417
SHA256

8c1c5ba560bf8b15b12a18822f4cef0e51ed8ffb2777ddf9248825774549564c
SHA512

12235d1609479e27b58910a10574af010cd6fc5d4831f7da06aeb70d2b163ae123de9c58116147da71edf11db17ee112f39f3d785cfc424bb6f5fb4c352a82f9
SSDEEP

3072:uNlC4SD6bJK8quJe3lSnUshy8Hm8E3N+82nYCqISU5ysGp:cU4SDSNU/sjY3aYClm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CryptFlr.exe

Files

CryptFlr.exe
.exe windows x86

43be4169b7858b613c6ec366d24e906d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA

user32

RegisterClipboardFormatA

gdi32

CreateRectRgnIndirect

comdlg32

GetOpenFileNameA

winspool.drv

OpenPrinterA

advapi32

RegQueryValueExA

comctl32

ord17

oledlg

ord8

ole32

CreateILockBytesOnHGlobal

oleaut32

SysFreeString

Sections

pec1
Size: 109KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE