C:\Users\FlyTech\Documents\Creep\Creep\obj\Release\000.pdb
Overview
overview
10Static
static
3BUG32.exe
windows7-x64
BUG32.exe
windows10-2004-x64
MEMZ 3.0/MEMZ.bat
windows7-x64
7MEMZ 3.0/MEMZ.bat
windows10-2004-x64
7MEMZ 3.0/MEMZ.exe
windows7-x64
6MEMZ 3.0/MEMZ.exe
windows10-2004-x64
7MEMZ-Destructive.exe
windows7-x64
6MEMZ-Destructive.exe
windows10-2004-x64
7Trojan.Win32.000.exe
windows7-x64
Trojan.Win32.000.exe
windows10-2004-x64
Trojan.Win...or.exe
windows7-x64
Trojan.Win...or.exe
windows10-2004-x64
Trojan.Win...sk.exe
windows7-x64
6Trojan.Win...sk.exe
windows10-2004-x64
6Static task
static1
Behavioral task
behavioral1
Sample
BUG32.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BUG32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MEMZ 3.0/MEMZ.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
MEMZ 3.0/MEMZ.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MEMZ-Destructive.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MEMZ-Destructive.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Trojan.Win32.000.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Trojan.Win32.000.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Trojan.Win32.BossDaMajor.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Trojan.Win32.BossDaMajor.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Trojan.Win32.KillDisk.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Trojan.Win32.KillDisk.exe
Resource
win10v2004-20240226-en
General
-
Target
Trojan.zip
-
Size
25.5MB
-
MD5
59a1b98dd557235b9a15eeeb7cc1c51e
-
SHA1
0a731b1ce5f1214fb925ae5566ae65ad40e77b16
-
SHA256
4b30f308a5f0cf34361f5a53f2d73c523188adbbd9ac264275946197a3a8aa28
-
SHA512
294cdd747e744dcfa5ae8baf3f8102a4393faa0593fbae0d2a68082b954a079a15b4f7072dbb1667b4c766aad800ef73e5526df4eef9cf5b0bf617a530387d53
-
SSDEEP
393216:V5EYRwa8J0+T3WCa+aKkXPSssursuNzI+nyDhSbfChI00y/DomC:XRU0i3ta5KkXq3uf+4bKhI0X0
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack002/BUG32.exe unpack003/MEMZ 3.0/MEMZ.exe unpack004/MEMZ-Destructive.exe unpack007/Trojan.Win32.000.exe unpack008/Trojan.Win32.BossDaMajor.exe unpack009/Trojan.Win32.KillDisk.exe
Files
-
Trojan.zip.zip
-
Trojan/BUG32.rar.rar
-
BUG32.exe.exe windows:4 windows x86 arch:x86
d7ee0bec939bda9b20c9cb9dcb985e30
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Sections
.code Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ReadMe.txt
-
Trojan/MEMZ 3.0.zip.zip
-
MEMZ 3.0/MEMZ.bat.bat .vbs
-
MEMZ 3.0/MEMZ.exe.exe windows:5 windows x86 arch:x86
02ea6193bc4d1a72912388cc9f90424b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CloseHandle
lstrcmpA
lstrcmpW
LoadLibraryA
GetModuleFileNameA
GetCommandLineW
Sleep
SetPriorityClass
CreateToolhelp32Snapshot
Process32First
Process32Next
GlobalAlloc
GlobalFree
lstrlenW
GetCurrentThreadId
CreateThread
ExitProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
CreateFileA
GetProcAddress
user32
ReleaseDC
GetWindowRect
MessageBoxW
SetCursorPos
GetCursorPos
GetDesktopWindow
EnumWindows
GetWindow
CallNextHookEx
GetWindowDC
UnhookWindowsHookEx
MessageBoxA
GetSystemMetrics
CreateWindowExA
RegisterClassExA
DefWindowProcA
ExitWindowsEx
DispatchMessageA
TranslateMessage
DrawIcon
SendInput
LoadIconA
SendMessageW
GetMessageA
SetWindowsHookExA
gdi32
BitBlt
StretchBlt
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
CryptAcquireContextA
CryptGenRandom
shell32
CommandLineToArgvW
ShellExecuteA
ShellExecuteExA
winmm
PlaySoundA
psapi
GetProcessImageFileNameA
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Trojan/Troja.Win32.MEMZ-Destructive.zip.zip
-
MEMZ-Destructive.exe.exe windows:5 windows x86 arch:x86
52753d226ff5a8a88caf9829928cd5d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CloseHandle
lstrcmpA
lstrcmpW
LoadLibraryA
GetModuleFileNameW
GetCommandLineW
Sleep
SetPriorityClass
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAlloc
GlobalFree
lstrlenW
GetCurrentThreadId
CreateThread
ExitProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
CreateFileA
GetProcAddress
user32
GetWindowRect
MessageBoxW
SetCursorPos
GetCursorPos
GetDesktopWindow
EnumChildWindows
CallNextHookEx
LoadIconW
ReleaseDC
UnhookWindowsHookEx
MessageBoxA
GetSystemMetrics
CreateWindowExA
RegisterClassExA
DefWindowProcW
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetWindowDC
DrawIcon
SendInput
SendMessageTimeoutW
GetMessageW
SetWindowsHookExW
gdi32
BitBlt
StretchBlt
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptAcquireContextW
CryptGenRandom
shell32
CommandLineToArgvW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
winmm
PlaySoundA
psapi
GetProcessImageFileNameA
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Trojan/Trojan.SymbOS.Skulls.A.zip.zip
-
Trojan.SymbOS.Skulls.A.sis
-
Trojan/Trojan.SymbOS.Skulls.F.zip.zip
-
Trojan.SymbOS.Skulls.F.sis
-
Trojan/Trojan.Win32.000.zip.zip
-
Trojan.Win32.000.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Trojan/Trojan.Win32.BossDaMajor.zip.zip
-
Trojan.Win32.BossDaMajor.exe.exe windows:4 windows x86 arch:x86
d7ee0bec939bda9b20c9cb9dcb985e30
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Sections
.code Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Trojan/Trojan.Win32.KillDisk.zip.zip
-
Trojan.Win32.KillDisk.exe.exe windows:5 windows x86 arch:x86
88d5fa607f81a4cf6307e004d5d03789
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
WaitForSingleObject
GetLogicalDrives
WriteFile
GetDriveTypeA
OpenProcess
Sleep
TerminateProcess
ReadFile
GetSystemDirectoryA
FindFirstFileA
GetCurrentProcess
RemoveDirectoryA
Process32Next
MoveFileA
FindNextFileA
CreateToolhelp32Snapshot
CloseHandle
DeleteFileA
CreateThread
GetProcessHeap
SetEndOfFile
SetFilePointer
CreateFileA
lstrcmpiA
GetCommandLineW
GetLastError
HeapFree
HeapAlloc
WideCharToMultiByte
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetStdHandle
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetFileType
SetHandleCount
GetStdHandle
DeleteCriticalSection
EncodePointer
DecodePointer
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
WriteConsoleW
MultiByteToWideChar
FlushFileBuffers
IsProcessorFeaturePresent
LCMapStringW
GetStringTypeW
HeapReAlloc
HeapSize
CreateFileW
user32
ExitWindowsEx
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
shell32
CommandLineToArgvW
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Trojan/Trojan.Win32.LoveYou.zip.zip
-
Trojan/Trojan.Win32.MrsMajor2.0.rar.rar .ps1 polyglot
-
Trojan/Trojan.Win32.MrsMajor3.0.zip.zip
-
Trojan/Trojan.Win32.YouAreAnIdiot.zip.zip