AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Behavioral task
behavioral1
Sample
CristalixLauncher.exe
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
CristalixLauncher.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
Loader.exe
Resource
win10-20231020-en
Behavioral task
behavioral4
Sample
Loader.exe
Resource
win10v2004-20231025-en
Target
MasViser.rar
Size
10.4MB
MD5
d411cb95504ecedbd40cb94724faa54e
SHA1
6471826a926681226e4680f42627ac8b609ee34a
SHA256
fc4a1821ab0506267497aeeef9c63703cacd5a7293a8c05d7bbce63b0fb77049
SHA512
e58c039d1eafb68ac0d780f33bd50a2fa232668675b12e9de0656befe202cc13e153faa64af104384d499fa710c290a0dda237e7d8376b61ac34106b4ab3d584
SSDEEP
196608:3JCTac1nAnIVtNozjak7N2JvGBdlxu+wnZY+jUDq22kWsWThi/mhZ:3cnAnRzjan8lxgnZQWjG6q0Z
resource | yara_rule |
---|---|
static1/unpack001/Loader.exe | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/CristalixLauncher.exe |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
GetUserDefaultUILanguage
FindClose
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetModuleFileNameW
FindNextFileW
GetLastError
CreateProcessW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
FindFirstFileW
SetFilePointerEx
WriteConsoleW
DecodePointer
GetEnvironmentVariableW
TlsGetValue
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
CreateFileW
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
GetACP
LCMapStringW
HeapAlloc
CloseHandle
HeapFree
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
MessageBoxW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
ShellExecuteW
SHGetFolderPathW
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
WriteProcessMemory
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ShellExecuteW
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
URLDownloadToFileW
__CxxFrameHandler4
__C_specific_handler
fwrite
malloc
_wcsicmp
_unlock_file
_initterm
__setusermatherr
_configthreadlocale
WTSSendMessageW
�t�b|�i �_����Tzz\�X��-�� �ٿ ęR5f�b`-aZ?�+�)��ƕ�+�)�6*9��l{3�5�i����w�0z����03G���㱒�'���<ɰ� ����B�Y�,꩝qf{��k��05q^ԛ��T�i2�:j�3�4��Y�v�0�S�OE�t[뾄�ge����X�QMk �������P1h���*�.��)3�I��U��T��7��ڵ�����ʝzc�ql�$��w�&<��/�N��ߒ��⋋7*C�}��.�i�R��~�敽�r����E1џ�r�c2B��@0|�k�^��B��������B�"�\u�%����|����%}n5B�5�#�m���=��L�{̟0 �JV3KhN�Vt�Dyh�ᅶ4��r���meD�$�H���%R���%�u���4P������N�G�.�0|�S�~�r��<�ST8�~{�A��@����by*Y�{��w����@��&���҄��jkdJ����l��ya���U0T(��]�^J� ?�k�_�MP�n�����Y��0��&�(R��S���ja�V�he���;� 7Ԑ�E�J�p�g�-M������Y�N����Vw!hK�Nr�^���f)���b���A5�Y*�%����b��pR��.�j?�Z�?�����?�0��:���\uk�t���t~�z�)�ʵ%�*4 ���+�Y�k�6Kb���%��9B����˫p�J�G�ES�(ip���������d�X�}�����1�PM�h�i��Mi�/>�@�2��c~��( \fJ��[%���E+S��z[�-�箼����ӆ\���4��bL�I��a6��f�����[�\0m.[,}'L���B�}��z4�i6���+Ļ)� �R�g�S%����;SVpr��#Ds=p/����+��t�u�A����c��%�B�,��f2�Ë�a8�\<\�+�-�?��n_v�!�ُv9w�;J۩B�gQ��;�����H�,�Ӵ���EqDNJ�/脬c�fڢ]��3m�+�IFɭ|��U�vI��'����&tf��'�25�ɘ{Ŗ϶:yڮn�=U��uꣁ'tA,���XI�A0U���7�}Kgn�z��2�)� ���"pOӝNQ�*q��������Y5s^�DT� �^.|����J��T��M(�-"ɒ�����{!tJ |j�*����+h���5U7����aC&�a6/���N�RwL�/��}k��5W�Q�4ݵ�?@x�XNB��\zw\���µF~o��9n�sMR�9�I{������,�g�ה̌<=����t����}��u���%�����P���:�7K��`?��M���ζ�����E�'fx�Bh��N����)�duN�����/6c�n�R�K*2''�����ɷzie��T)�Md�+�`_�~����aU�TUF�����7[���h6��@ǐ�p�e�>.�^�%�L�"`֞��ހ�l�J�8�>�*��c��z�6~��{��!+m�9�a,�ι,8{g�U~����� %��wsE�F�jkJO��'���������Yt�X!O��hM��khV?���j���k�i���T1��*<�r���C|c���FA����C�'��g#���\A�3ڟ��8�QBR��Ե���Ur,�"ȹ0H��n[������s��{w��4y����� ��Ҿ����F���6�2<�s���r�`l9�}�I���柾uzmK ��G� x-K��=�A�[��sR֎r[4z��%��@��:tdl�X�F�_}|��K7]�oV Y^��x� ��/����*CM�/VhW��k�]bm�����C�&�����T�����%Ib�C��u���sCRݵ����Ju|_R�A���2�:��G�E���� �ǽ��!�+ih#����gj����g����َZ�4*��2E�h��%"(Z{�g�'y )�k�F��,R)Ǿb�k��dڋV~m��ؓ�p��4���,��,��}��u֜�,���<�G���#�����ۚ�0C�%I_�|�U1�.���4�W~��A�O�`��o��H����65Z6�o&nQ�s:����ߠ�Ak�a���sŊ�>Y͢�1�7����Ït`�.�N�%������T�/.���y����Ћh�̫���&��!���AJ*����ᵒ\�ނ�Qw�3��q��B�u���j3�a����h��K��G��ґ�"S"�Ź!-��&B��qZ�j`Mq�AsY̓�nM���W�cGEQTo����2%7�Q�l@� ����F�����U��[�<�*�v�j���O���CLL��E����?ѢG�!�Y�J�����w�� �G�bR���۵��f�V���lͭ�qd�e&�r��RS6b�����M�ar��nH�zH�8[� ��i;3�����=p�ǵ��I�y%�;��W7];��!(#�i~O�I�d̍d��cN����,z�����@H2e�ƴnN�I�0I�]�[�����2��#��=�52o��wq�P�4 .�N3��[N�Ĭ�.�gKkE�hd�A7��O��t��VΉ�9���`��#$����K�gF?�-�T��lW��b;��Th�`����'���w>(!wff��K����"��e�܉�b?��W�ů���':+�_� ��N�̚ǎ��sP�ePEB���Az%� �\����!�����(!�(�U�����>�IM�N���u�h�r��v�nr���ܤ�P|H����筱�w����r����݈r5xW���b ����U��yT{GT��cjb�RW���O�y��v%E�<�M���$eS�q`�L�;*Q�3� w��|ϐ4�9�0�X?$��>7�V�����V�sie��ʽ�49-iQ��+���[�j��j�I��^��>��_*�%Qx�$�G@����6�g�w-I�L���.�s�����m�̺)v�����6�^�q��jj,N�F�g��-��E�mm`˲T�� :�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ