����Z4k^�xP?U#�#Z���k�f�1:}���e��D�˯�覦'zHz���P c��Z�(Vȱ�ϕgX����,�@�ٹB�����q�NB�ȿd�\�5�}�^�pVI�L�?]D���=�L�V��p�� �h���kN���a�u%�XC��@�7|8��ɝ��Q�[;7�3��h�~n��0Uy�үk�U�E���D P-��ct��N&uL!"C��2G�Н��;�~Td*N���+=��2�b�{��U�]�\z ﴽ���f���� }�.M�������u�Pl��Y�P�&����gv/�Bo%���d��wЍ�,��{U��l1a`�"a��KO��2(a��n�'<�{�s���0�_+g�y�%*�AQh���@����CY%�S������g79nw���+!E;�p��2R�$|���(������ɾ���I?σ�?|qMq�pm�r�g$\��J�)@�G���u��p�<�+kW*�j����s� 2:��,j� [j�0����QJ�-3�n?�r�U8;;��$F����_��RM��H�R���(�k��#���H��LoJ]U���y<l^��g#_'���i�x���gػ��\�~u�Q�\/�i5���A�ι�J "ڬ1�2C�I@e�y5�c>��Դ�L�K�D��o��_Eh���ݼk��(�&���j�V���2C�+b�o�ؗn���ز}��#{����^up��1{ �%lH�6��#������j��E�~"�mk~��*r�'FJb�}��`�G>f�c,�Ж3��9��+�#Qh�I.+��Q�^[FA�z�,|�>�,%x�n��e��]T;�{ޓ������1/�Z����5��B:Y���.���w �|�"�AR�(ߚ��L���iB@�V�s��ĕ C�d$�5����K��Kjq)��[$dy%��.iM�B-'3�&��p͔:��_���Y���/?�����d��w�@؍�CU!O�Y���/��F�é�f�;���H���ɳ�j�&�(&LKU�9�B{�M��O�sӸ��B���!�n� 9��̨v�7����8Ro�%����0����^5��ί�� ���;pm�����~�2���vڷ�?:P(�b��������˃�`��R��}dWW��T�����|]�����ύ�/ ����|!{�;���}#��Tu����� z���!����H~h��{����aq�4e�����j�k��7�j�{X�x?av2�V"䊆��UQ�οul��f>����)����OGi�J�h�S�p��e�M�@������r��@j2��ny�i˿� ����ެc�d\J�2�>z��,�����s�������u�� �n�i�����l�Q��x�����䬰 D�Y��b��4�*6i�3��YZ���YY�Es!p#�������G���~����+�,���9�7[1j��[��8+�����tl=������~Y�6`��Q��,�����t�1g�m���g�dl���Ӫۤ�O���'n�&�UVȱBx�_�R��>��w5ޓ����E�R�"�����pJ�҇ ���owMpy.�jsc;��V�fq��r�î�1F����݁��|{�}�f���7?��P3^s�nT��TFЗ�W���zK����(�@@�������U��(#)w9����ʀ˽*�}����'�������TPERPOf��������5�OH����}t���E�a�Yǝ�5�.8RM�����@gCŇ�B{]��O!�'�Q�uaӎ� �:FX�,��3]�`�m�� ����xh��H�+o9E����Ń�rXă[�R�tWKu�+�}㌇����x��#���x�0 !�}w,����?�"��o�Sf�9@/w�&Fկf6,]a�q���Q�@���%J+d�� �^L˓w(s�0GUƗ�_Vl�g� 0��(_��ES��YN�H�*r����e����< <���`���ˬc?sw����վ�F����R���P�^/�q��(����������>����G1��s�/�eru���6E�sh���ԫ�� ��f����画T��T�0�j�\�)9�T�s�jXS��CE`Y�M���YT��T���FQ"]p�|2�>��1t}q�JI��Iu��Vj�Y�~���54Oe�d�����۾~s�#H� 0�m�W��p�������|U wU~�u�� �g�Jr�oalwf�|��������������r����W�;<;�7�U%� �O}����sԋ����OF���b൚�ﺲ�G�Jç�,\�0�.?��V�J�j+��q!�+�.q�w���jI�v�!���8���K����Z��Wm~ {�he��~�A/����Ζm��F�OMD�KͶ�5Z���59�D}�FD��0�$��r�R�cy�}R����~��ZM�r���a��"ri��%��v]�C����K;�����e��ƭ��+�.u8����.���m�<(nR ��vʢױ�������2*�FW�{ȁ`(NVƵ�K���MPFщ{G��x.�>���M��ϙe�_�*���O�� �^>m���ӎPk]��Gh p,.�֯Xu:�[J}9�iS��&V2}DG�3�B߭���Hsg�����_��44�f��KR'�h*�5�ޛmN:'�c�B���{)���dCqv�X\�S7�n�o�'�щ��R��z嫖�؋��b��&s2G�U�{����te9n���q���{P���';�{o�u9��\1�O�P�^4�B$�����*���0��*��I�y��}��0���Zi�X��B�tX\�ߤ: g ��@�7A�H�lr��!�-y{:ԟ��إ�?�?"lS�#��.eU�m�����۽/zV'Sz�'x�Ke5^���)������b����7fpv����3 { � B����%�t>�Q���&��ۑS"C_R�4kP=,�#���/�1dUG��mŵ�W����kM�՜���mdۛD�K'��C����^x-wްa+���[6>p��K���ژM�Ӈٱ~��\
Static task
static1
Behavioral task
behavioral1
Sample
CrystalDiskMark6_0_0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
CrystalDiskMark6_0_0.exe
Resource
win10v2004-20231215-en
General
-
Target
CrystalDiskMark6_0_0.exe
-
Size
21.0MB
-
MD5
3748c20f4f0606f4e1bc287be47104d8
-
SHA1
02d57875e06d2342a034dba648fbe11ebba3a808
-
SHA256
68ccca8040620c09cc57b9651cae501ae785c450f9c13d93cbf6004fc14ff169
-
SHA512
97c778c3180f7572a0c970de0974038c6407b551ab613098a26563e05d73554fba56413927b8c9e48ad0791f2dc005bf8351968d4b7ed2a9bacb40d7f55fc659
-
SSDEEP
393216:LdRFDqMKNd9zIWgAz4fPEMRR+7lMSf2dwySPkwv9YBSQ/POlOeKBguy:LFDvKDIPEv7lMSfIwXPkM9y1NBxy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CrystalDiskMark6_0_0.exe
Files
-
CrystalDiskMark6_0_0.exe.exe windows:6 windows x64 arch:x64
77a4a5ea9b46d4430182aa4480dbcffd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getaddrinfo
ole32
CoInitialize
wtsapi32
WTSQuerySessionInformationA
WTSSendMessageW
kernel32
GetVersionExW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
oleaut32
SafeArrayDestroy
advapi32
CryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 800KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.drp0 Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.drp1 Size: 12.1MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ