Static task
static1
Behavioral task
behavioral1
Sample
Crosshair.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
Crosshair.exe
Resource
win11-20231215-en
General
-
Target
Crosshair.exe
-
Size
358KB
-
MD5
b863bdb793b803b7a14e7721b80abf5f
-
SHA1
c81b8f5b2c6e55cd343dc362432e90cf5cbfdc53
-
SHA256
97c2b4e4a3197a13fceac367f74516b3d41115f5ad57845670a9294526e7f258
-
SHA512
21a6f87cca55d3484f9c9913e093a084b92ca80113399e1bf127e6db4cbf17e0ce29fb31b12ac52144aab2669fb0294205233bbfc1f80174ac9d0fc9753622ee
-
SSDEEP
6144:92dZLwsx7JCLYXwqSWu4vsr4sorr1hw8fSEu2pbPH3tNoXrSSJneDaygSSI31+Gv:/uMWDaoVeE9TWI3Mu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Crosshair.exe
Files
-
Crosshair.exe.exe windows:6 windows x86 arch:x86
6ef7892563a6121e64239e6dbf0c5e16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetTickCount
GlobalFree
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceFrequency
GlobalUnlock
WideCharToMultiByte
GlobalAlloc
GlobalLock
MultiByteToWideChar
UnhandledExceptionFilter
LeaveCriticalSection
user32
GetCursorPos
SetCursorPos
SetClipboardData
GetClientRect
GetWindowLongW
GetAsyncKeyState
SetWindowLongW
GetDesktopWindow
SetForegroundWindow
DefWindowProcW
GetWindowRect
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
GetClipboardData
PeekMessageW
SetLayeredWindowAttributes
TranslateMessage
PostQuitMessage
UpdateWindow
GetKeyState
GetMessageExtraInfo
OpenClipboard
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
IsWindowUnicode
CloseClipboard
EmptyClipboard
ReleaseCapture
SetCursor
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
vcruntime140
memset
_except_handler4_common
memmove
memcpy
memchr
__current_exception_context
_CxxThrowException
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
__CxxFrameHandler3
__current_exception
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
ftell
__p__commode
_get_stream_buffer_pointers
_set_fmode
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fflush
fgetc
__stdio_common_vsprintf_s
fclose
fputc
fseek
__stdio_common_vfprintf
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
strncmp
tolower
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
atoi
strtof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_stat64i32
_lock_file
api-ms-win-crt-runtime-l1-1-0
_cexit
_crt_atexit
_seh_filter_exe
_set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
terminate
_controlfp_s
_configure_narrow_argv
_initialize_narrow_environment
_errno
api-ms-win-crt-math-l1-1-0
_libm_sse2_sqrt_precise
ceil
_libm_sse2_acos_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_CIfmod
_CIatan2
__setusermatherr
_libm_sse2_cos_precise
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 302KB - Virtual size: 301KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ