CrashSender1403[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

CrashSender1403.exe
Size

929KB
MD5

2829ab15fff44c84d319274ab61bc4dd
SHA1

f825f839e0eb35077be24c2692b42c31b4541411
SHA256

a8f3dc44c4de1d96a1c4491686f54e1931387df800653be71458ba11863a00c4
SHA512

b689d95fe217307736e0240f3f919646f69e953d007ea89b71207a149f8f5d4710307c1d248f755e40a564ada49de9e1fdd926984f45ce2f6e4c872dbca8eb1a
SSDEEP

24576:j3Qot4CtMnlVl8OsmVEpAymT3cVPjeDzh2A2I5fZBTQgsPfU:ko3twVl8OsmVp3cBCDzhn2I5fHTQfU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CrashSender1403.exe

Files

CrashSender1403.exe
.exe windows:5 windows x86 arch:x86

68bb6d40e5fb17486e7abe98c2fec49d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ntohs
inet_ntoa
inet_addr
htons
htonl
closesocket
connect
recv
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
getservbyname
getservbyport
gethostbyname
gethostbyaddr
socket
send

dnsapi

DnsQuery_W
DnsFree

wininet

InternetWriteFile
HttpOpenRequestW
HttpSendRequestExW
InternetReadFile
InternetCloseHandle
InternetSetOptionW
InternetQueryOptionW
InternetConnectW
HttpQueryInfoW
HttpEndRequestW
InternetOpenW

rpcrt4

RpcStringFreeA
UuidToStringA

psapi

GetProcessMemoryInfo

gdi32

GetDIBits
CreateDCW
SetViewportOrgEx
TextOutW
CreateHalftonePalette
GetDIBColorTable
CreateDIBSection
SetStretchBltMode
StretchBlt
SetDIBits
SelectPalette
SelectClipRgn
SetLayout
CreateCompatibleBitmap
RealizePalette
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
SelectObject
SetBkMode
SetTextColor
GetObjectW
Polygon
CreateSolidBrush
SetBkColor
BitBlt
CreateFontW
CreatePalette
CreateRectRgn
CreateCompatibleDC

shell32

SHFileOperationW
ExtractIconW
SHGetFileInfoW
ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
SHGetSpecialFolderPathW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

GetTimeZoneInformation
LoadLibraryA
GetSystemDirectoryA
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
IsDebuggerPresent
GlobalUnlock
GlobalLock
Sleep
InitializeCriticalSection
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateProcessW
EncodePointer
QueryPerformanceCounter
VirtualFree
CreateMutexW
ReadFile
WriteFile
GetFileInformationByHandle
InterlockedIncrement
InterlockedDecrement
CloseHandle
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
lstrlenW
CreateFileMappingW
OpenFileMappingW
FreeLibrary
GetProcAddress
GlobalAlloc
GlobalFree
GetCurrentProcess
GetLastError
DebugBreak
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FormatMessageW
lstrlenA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
OutputDebugStringW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
WideCharToMultiByte
GetProcessTimes
OpenProcess
SetLastError
ReadProcessMemory
GetFileSizeEx
FindClose
GetSystemTime
FileTimeToSystemTime
GetFullPathNameW
CreateFileW
FindFirstFileW
FindNextFileW
CopyFileW
DecodePointer
FlushInstructionCache
RaiseException
GetCurrentThreadId
LoadResource
SizeofResource
MulDiv
lstrcmpW
lstrcmpiW
LoadLibraryExW
GetCommandLineW
FindResourceW
CompareStringW
GetVersionExW
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateThread
GetSystemTimeAsFileTime

user32

SetScrollInfo
DrawTextExA
KillTimer
SetTimer
CharUpperW
SetProcessDefaultLayout
PostMessageW
IsDialogMessageW
GetIconInfo
LoadIconW
CopyRect
MessageBoxW
AdjustWindowRectEx
DrawTextExW
DrawIcon
GetMenu
EnableWindow
DialogBoxParamW
FlashWindow
PostQuitMessage
GetMonitorInfoW
MonitorFromWindow
MonitorFromPoint
CheckMenuRadioItem
SetWindowTextW
SetMenuItemInfoW
TrackPopupMenu
DeleteMenu
GetSubMenu
EnableMenuItem
DestroyMenu
LoadMenuW
GetActiveWindow
EndDialog
SystemParametersInfoW
LoadImageW
DestroyIcon
LoadCursorW
GetClassNameW
GetParent
GetDesktopWindow
PtInRect
EnumWindows
SetRectEmpty
FillRect
DrawFocusRect
GetScrollInfo
GetSysColor
ScreenToClient
GetCursorPos
SetCursor
GetWindowTextLengthW
GetWindowTextW
RedrawWindow
EndPaint
BeginPaint
ReleaseDC
UpdateWindow
DrawTextW
IsWindowEnabled
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
GetDlgItem
CreateDialogParamW
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
SendMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetGuiResources
LoadStringW
GetWindow
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
GetDC
CharNextW
MoveWindow
AnimateWindow
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
GetSysColorBrush
IntersectRect
GetWindowThreadProcessId
EnumDisplayMonitors
GetCursorInfo
OffsetRect
InvalidateRect

advapi32

RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegEnumValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid

oleaut32

VarUI4FromStr
VarDecCmp
VarI4FromStr
VarR8FromStr
VarDateFromStr
VarDecFromStr
SysFreeString

comctl32

_TrackMouseEvent
ImageList_Create
ImageList_ReplaceIcon
ImageList_Remove
InitCommonControlsEx

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??0id@locale@std@@QAE@I@Z
?_Xbad_alloc@std@@YAXXZ

msvcr120

_gmtime64
strcpy
longjmp
strtod
_ftelli64
_fseeki64
isspace
strncmp
atof
ftell
fopen_s
_vsnprintf_s
sscanf_s
fputc
fseek
strncpy
tmpfile
getenv
sscanf
ferror
fflush
exit
__iob_func
sprintf
qsort
realloc
toupper
ceil
srand
rand
calloc
strtoul
labs
strncpy_s
strchr
strcat_s
strcpy_s
isdigit
__CxxLongjmpUnwind
_wtol
atoi
wcsncmp
_setjmp3
rewind
_localtime64_s
sprintf_s
fopen
fabs
fread
feof
wcsftime
fwprintf
_wstat64i32
_wcsicmp
_recalloc
malloc
wcsncpy_s
strcmp
iswspace
isalnum
strlen
memcpy
memcmp
memchr
_hypot
_purecall
fprintf
fclose
_wfopen_s
_time64
_gmtime64_s
strftime
vswprintf_s
swprintf_s
_wtoi
_wdupenv_s
free
wcstok_s
wcsstr
wcsrchr
wcspbrk
wcslen
wcscspn
wcscpy_s
wcscmp
wcschr
memmove
memmove_s
memset
iswdigit
__CxxFrameHandler3
_CxxThrowException
??_V@YAXPAX@Z
memcpy_s
??2@YAPAXI@Z
??3@YAXPAX@Z
abs
pow
abort
isalpha
tolower
_XcptFilter
?terminate@@YAXXZ
_onexit
fwrite
_wfopen
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
_exit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
__dllonexit
_calloc_crt
_unlock
_lock
_except1
__crtTerminateProcess

Sections

.text
Size: 629KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68bb6d40e5fb17486e7abe98c2fec49d

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

dnsapi

wininet

rpcrt4

psapi

gdi32

shell32

comdlg32

version

kernel32

user32

advapi32

ole32

oleaut32

comctl32

msvcp120

msvcr120

Sections

.text Size: 629KB - Virtual size: 628KB

.rdata Size: 173KB - Virtual size: 172KB

.data Size: 5KB - Virtual size: 6KB

.rsrc Size: 99KB - Virtual size: 99KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 629KB - Virtual size: 628KB

.rdata
Size: 173KB - Virtual size: 172KB

.data
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 99KB - Virtual size: 99KB

.reloc
Size: 22KB - Virtual size: 21KB