009bab833983c5cc0bed40eb41d3bea6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

009bab833983c5cc0bed40eb41d3bea6
Size

4.1MB
MD5

009bab833983c5cc0bed40eb41d3bea6
SHA1

9d120a182d001e4944dcb782aceecbd5c236440b
SHA256

5d2e6bb82c8b7e0db106864ab3f4fee7e8ba4f1d6a4c40c69ed50956755b6947
SHA512

c0c1903329d83d607b8467860d56e0573a13d365eeb71f7a6bfc4443334493edbaefbf87a979e558bca7cf80dd65b0ebf27605c3ec142463c01052f9ee2898d9
SSDEEP

98304:pHE+BtboxwAO2/F4gTvoq9AiuiAvrVNWXfCS47S:q+/aOeF4gTvo2AiujvXWXfa+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CRACK/Keytro.exe

Files

009bab833983c5cc0bed40eb41d3bea6
.rar
CRACK/Keytro.exe
.exe windows:5 windows x86 arch:x86

e02e71b0b16aef282ea1d5b77d2f1784

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glPolygonMode

glu32

gluOrtho2D

rpcrt4

UuidCreateSequential

crypt32

CryptProtectData

kernel32

LoadLibraryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DispatchMessageA

gdi32

SetPixelFormat

advapi32

RegCloseKey

winmm

waveOutPrepareHeader

Sections

.text
Size: - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

19110
Size: - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

19111
Size: 559KB - Virtual size: 558KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE