Behavioral task
behavioral1
Sample
RUNME.bat
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RUNME.bat
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
crack.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
crack.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
install.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
install.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
keygen.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
keygen.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
patch.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
patch.exe
Resource
win10v2004-20231215-en
General
-
Target
3a82e109926869b7c700398935232c92
-
Size
77KB
-
MD5
3a82e109926869b7c700398935232c92
-
SHA1
107f61af5540e55320176e27798c1699fff4d9ae
-
SHA256
7d40ae3f2bac440e1136dcc3d45d71c1cfeeeba074be42a68d0bd93a5e3545ea
-
SHA512
cdbb28d920d90c99f6e879c3fec19eb17ee4afc41043c5b0437d8cc6622904e62c24a83559ddb01703918ef33504f042cbf06a5a06c735cdb5bae6629e6e6c56
-
SSDEEP
1536:HaTITAhk85GwsvDT6XnBJ55Um8Y6itbsxj3HFGHNDFahz/vIag5K7oXp4dlCjRR5:HaEkhkyGwsaXRCm84slHUCBA5GqalCjF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/install.exe upx -
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/crack.exe unpack001/install.exe unpack002/out.upx unpack001/keygen.exe unpack001/patch.exe
Files
-
3a82e109926869b7c700398935232c92.rar
-
RUNME.bat
-
crack.exe.exe windows:4 windows x86 arch:x86
f228153db4539716b66464ca4a002b07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
BuildCommDCBW
CreateNamedPipeW
GetFileAttributesExW
GetModuleFileNameA
BuildCommDCBAndTimeoutsA
GetWindowsDirectoryW
FindResourceA
GetConsoleAliasesW
GetLongPathNameA
GetProfileStringA
CreateMailslotW
GetCommandLineW
user32
CallMsgFilterW
LoadImageA
ModifyMenuW
MapVirtualKeyA
DefMDIChildProcW
SetWindowsHookA
gdi32
PolyTextOutA
TextOutA
TextOutA
CreateMetaFileA
GetCharABCWidthsA
GetICMProfileA
GetCharacterPlacementA
Sections
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1024B - Virtual size: 862B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.��� Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
install.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
RYeB Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RYeB Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
keygen.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
patch.exe.exe windows:4 windows x86 arch:x86
5a9460aaf05c1c5daafc9ea4681306e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
lstrcmpA
lstrlenA
FindAtomA
lstrcpynA
GetModuleFileNameA
CreateMutexA
CloseHandle
GetTickCount
GetVersion
GetTempPathA
GetSystemTime
WriteFile
lstrcpyA
GetCommandLineA
CreateProcessA
lstrcatA
GetLastError
GetProcAddress
GetTempFileNameA
GetLocalTime
LoadLibraryA
ExitProcess
OpenMutexA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualQuery
GetVersionExA
RtlUnwind
IsDebuggerPresent
user32
wsprintfA
ClientToScreen
GetCursorPos
GetCaretPos
GetWindowRect
EqualRect
IsWindowVisible
GetFocus
InflateRect
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE