Static task
static1
Behavioral task
behavioral1
Sample
crackme.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
crackme.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
crackme.exe
Resource
win11-20240221-en
General
-
Target
crackme.exe
-
Size
64KB
-
MD5
c7a671d30c8e8dc1d99f0f3a9767afec
-
SHA1
43175d92e9b307a3c6d4ae9ab9fc40b01b84ecc1
-
SHA256
b15f98ba8ebfdf2df3f256bb185206ef55c5504c50c4943d266943da0e7dd7d2
-
SHA512
d7691650451a86353efb2ba2df95358a84c07f8459e557fc347ccdf716f2b750c9049c3dd96e12bf387b4d420172a0a2d7f94793329d1a881f99f33fe45df685
-
SSDEEP
768:DUqGuqGDLjSshA73VeMCm3pQHVBoDKOuMy5EHyT4dLrpz81V9u6ZPSHY8Iq:dqGK5FdKBoD9HW4dXpI1VY0q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource crackme.exe
Files
-
crackme.exe.exe windows:6 windows x64 arch:x64
649d5827cf74f55047bfa549f13fd11c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__std_terminate
memcpy
__current_exception_context
__current_exception
memset
api-ms-win-crt-runtime-l1-1-0
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_c_exit
_cexit
__p___argc
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
__p___argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
kernel32
RtlCaptureContext
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
IsProcessorFeaturePresent
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 456B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.0Dev Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ