Static task
static1
Behavioral task
behavioral1
Sample
GlyphCrashHandler64.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
GlyphCrashHandler64.exe
Resource
win10v2004-20230703-en
General
-
Target
GlyphCrashHandler64.exe
-
Size
1.8MB
-
MD5
a41f288c276a9b4be0fcf9a5f6608810
-
SHA1
ad6163904a9e8b7003e0d65d98db138d5e4ba905
-
SHA256
0c341d06fcbd29e2eff56bc656e1d52ee8f300c7ca8d28ebb73a1718855810f2
-
SHA512
2fc7a1c25d25a19e61c3bc94b277c4b616336e4abe6c937881b287bc037399d80d4012ea7031b1017f0b406efbcecc97d730e038d337b116fd221bcac0095288
-
SSDEEP
24576:1GTTNxfuaxjMhwhFNjlYEYGnJpYP3TZatp5tt4+Uc0U1Jw:1ybj1hTlYDOJtp5tt4+Uc0n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GlyphCrashHandler64.exe
Files
-
GlyphCrashHandler64.exe.exe windows x64
9cfe9385cb7e15420d819a8a93811d44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
LocalFree
FormatMessageA
FormatMessageW
GetTempPathA
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesExW
GetFileInformationByHandle
GetTempFileNameW
WaitForSingleObjectEx
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetLocalTime
GetSystemInfo
GetSystemDirectoryW
GetComputerNameExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CopyFileW
FileTimeToSystemTime
SystemTimeToFileTime
OpenProcess
VirtualQuery
OpenFileMappingW
FreeLibrary
LoadResource
LockResource
SizeofResource
LoadLibraryW
FindResourceW
ContinueDebugEvent
WaitForDebugEvent
DebugActiveProcess
DebugActiveProcessStop
SetEvent
WaitForSingleObject
CreateEventW
OpenEventW
OpenThread
SuspendThread
ResumeThread
GetThreadContext
GetModuleHandleW
DebugSetProcessKillOnExit
DebugBreakProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GlobalFree
GetCommandLineW
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentProcess
GetModuleFileNameW
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
CreateMutexW
CreateThread
CreateProcessA
GetProcessId
GlobalMemoryStatusEx
GetWindowsDirectoryA
IsWow64Process
GetModuleFileNameA
CallNamedPipeW
GetTickCount64
HeapAlloc
HeapFree
GetProcessHeap
SetConsoleTextAttribute
GetOverlappedResult
SetFileTime
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
FindNextFileW
MoveFileW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
DecodePointer
EncodePointer
IsProcessorFeaturePresent
CloseHandle
GetLastError
GetTempPathW
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFileEx
LockFile
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateFileW
GetEnvironmentVariableW
CreateFileA
user32
RegisterClassExW
CreateWindowExW
DestroyWindow
PeekMessageW
DefWindowProcW
TranslateMessage
GetDesktopWindow
DispatchMessageW
advapi32
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextW
shell32
CommandLineToArgvW
ShellExecuteExW
ord165
SHGetFolderPathW
ole32
StringFromGUID2
CoTaskMemFree
CoCreateGuid
StringFromCLSID
dbghelp
MiniDumpWriteDump
psapi
GetModuleFileNameExW
GetProcessImageFileNameW
GetProcessMemoryInfo
iphlpapi
GetAdaptersInfo
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpWriteData
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpSetCredentials
msvcr120
toupper
_strnicmp
strstr
wcsncmp
wcsstr
ceilf
_vswprintf_c_l
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_wcslwr
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
_vsnprintf
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
isalnum
_wassert
fprintf
wcschr
iswspace
tolower
_strtoui64
_strtoi64
mbstowcs
_splitpath_s
strtoul
strtol
strtod
isspace
isalpha
_open_osfhandle
_chsize
_ftelli64
_fileno
_fdopen
_errno
_snprintf
_wsplitpath_s
_ui64tow
ftell
fseek
fread
fopen
strchr
memchr
__C_specific_handler
_itow_s
_wtoi
_unlock_file
_lock_file
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
memcpy_s
_beginthread
ldiv
wcsncpy
__CxxFrameHandler3
_CxxThrowException
??1bad_cast@std@@UEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@AEBV01@@Z
??0bad_cast@std@@QEAA@PEBD@Z
_vsnprintf_s
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
_vsnwprintf_s
_wfullpath
wcstombs_s
srand
rand
_wcslwr_s
_wcsicmp
wcsrchr
strncpy
iswalnum
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
strcmp
memset
memcpy
memcmp
_localtime64_s
strncmp
memmove
realloc
malloc
free
atoi
_exit
msvcp120
?_Orphan_all@_Container_base12@std@@QEAAXXZ
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Xruntime_error@std@@YAXPEBD@Z
_FInf
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Mtx_destroy
_Mtx_init
??0_Container_base12@std@@QEAA@XZ
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??0facet@locale@std@@IEAA@_K@Z
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Strxfrm
_Strcoll
_Getcoll
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7ios_base@std@@6B@
?id@?$ctype@_W@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
version
VerQueryValueW
GetFileVersionInfoW
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ