crack[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

crack.zip
Size

39.1MB
MD5

18eab0601cd5199fbea730b76e98944d
SHA1

449ade252c3dc1caf925c0cf6252ff4c22665fc5
SHA256

c3e3abcf18151d471eef6e1df12467a802156b8fbb9f6c962fafbdf5fc7f6ba9
SHA512

b55d2daec359bbd3d6bd30e7a75de65a99c33dd9cd075aedf5b71a63278eabf8d581a13aa5c26e6318b2c9dd73254d32ec093c1ba80d0d19de1b52ee52e5492c
SSDEEP

786432:T8Yzs+AGd6aGT8dMKYawo9JwsfPttkEHNWI3HXoHz8eG5pI5vpzKoSFK9be81Ea1:T/HHdAT82KayPZNAgn3wNnJe8qi

Score

1^/10

Malware Config

Signatures

Files

crack.zip
.zip
crack/RStudio32.exe
.exe windows:5 windows x86 arch:x86

6160abaf20392b47b0acba564202ea89

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:51:60:d1:6c:97:ef:8c:ed:f0:3c:bc
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

30/03/2021, 12:35

Not After

30/03/2024, 12:35

Subject

SERIALNUMBER=1461834,CN=R-Tools Technology Inc.,OU=R-Tools Technology Inc.,O=R-Tools Technology Inc.,STREET=10520 Yonge St Suite 232,L=Richmond Hill,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13074f6e746172696f,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

46:89:a8:8d:04:18:38:2a:78:9d:3b:7d:a0:ed:68:2c:2c:2c:31:21
Signer

Actual PE Digest

46:89:a8:8d:04:18:38:2a:78:9d:3b:7d:a0:ed:68:2c:2c:2c:31:21

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\GIT\DataRecovery\rapps\Batch\RStudioQt.pdb

Imports

mpr

WNetOpenEnumW
WNetAddConnection2A
WNetCancelConnection2W
WNetCancelConnection2A
WNetEnumResourceW
WNetCloseEnum
WNetAddConnection2W

kernel32

ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
CreateProcessW
VirtualQuery
CreateMutexW
ReleaseSemaphore
OpenMutexA
DuplicateHandle
OpenFileMappingA
CreateFileMappingA
InterlockedExchange
OpenEventA
ReleaseMutex
InterlockedCompareExchange
WaitForMultipleObjectsEx
CreateSemaphoreA
CreateNamedPipeW
CreateNamedPipeA
ConnectNamedPipe
GetNamedPipeHandleStateW
GetNamedPipeHandleStateA
MultiByteToWideChar
GetVersion
GlobalFree
TerminateThread
GetExitCodeThread
InitializeCriticalSection
CreateEventW
lstrcmpiW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetLocalTime
CreateFileW
CreateFileA
WaitNamedPipeW
WaitNamedPipeA
CreateEventA
DisconnectNamedPipe
ReadFile
SetLastError
WriteFile
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
WaitForSingleObject
SetEvent
GetLogicalDrives
GetCurrentThreadId
GetFileAttributesW
FormatMessageW
GetExitCodeProcess
TerminateProcess
GetCurrentThread
OpenProcess
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
CloseHandle
InterlockedDecrement
InterlockedIncrement
CreateMutexA
LocalAlloc
GetLocaleInfoW
GetModuleHandleW
SetErrorMode
GetVolumeInformationW
GetCurrentProcess
GetTickCount
LeaveCriticalSection
EnterCriticalSection
VirtualFree
WideCharToMultiByte
DosDateTimeToFileTime
Sleep
RtlUnwind
RaiseException
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCompact
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetCommandLineA
GetStartupInfoA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetModuleHandleA
HeapCreate
HeapDestroy
FatalAppExitA
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetCurrentProcessId
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
InitializeCriticalSectionAndSpinCount
CompareStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CompareStringA
SetEndOfFile
GetProcessHeap
VerifyVersionInfoW
VerSetConditionMask
GetSystemTime
CreateSemaphoreW
QueryPerformanceFrequency
SwitchToThread
SetThreadPriority
ResumeThread
GetThreadPriority
LoadLibraryExW
GetStartupInfoW
OutputDebugStringW
GetSystemDirectoryW
LoadLibraryW
SystemTimeToTzSpecificLocalTime
FindClose
FindFirstFileW
GetFileInformationByHandle
CreateDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
CopyFileW
MoveFileW
DeleteFileW
GetFullPathNameW
FindNextChangeNotification
DeviceIoControl
GetFileAttributesExW
SetCurrentDirectoryW
SetFilePointerEx
WaitForSingleObjectEx
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultUILanguage
CreatePipe
PeekNamedPipe
FindNextFileW
FindFirstFileExW
ExpandEnvironmentStringsW
GetDriveTypeW
GetUserDefaultLangID
IsValidLanguageGroup
lstrcmpW
GetLongPathNameW
GlobalSize
GetProfileStringW
GetFileSize
GlobalMemoryStatus
FlushConsoleInputBuffer
SystemTimeToFileTime
SetSystemTime
ReadProcessMemory
GetThreadSelectorEntry
GetThreadContext
SuspendThread
DeleteFileA
GetWindowsDirectoryW
Process32NextW
Process32FirstW
GetSystemDirectoryA
GetVersionExA
FormatMessageA
MoveFileA
RemoveDirectoryA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
SetFileAttributesW
FindNextFileA
FindFirstFileA
SetFileTime
CreateDirectoryA
GetDriveTypeA
GetVolumeInformationA
PulseEvent
GetEnvironmentVariableA
GetTempPathA
GetEnvironmentVariableW
BackupWrite
GetFullPathNameA
BackupSeek
BackupRead
CreateProcessA
SetConsoleTitleA
AllocConsole
VirtualProtect
WriteProcessMemory
lstrcmpiA
LoadLibraryExA
CallNamedPipeA
DefineDosDeviceA
GetDiskFreeSpaceA
SetHandleInformation
ExpandEnvironmentStringsA
lstrlenW
lstrlenA
GetSystemInfo
VirtualAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteCriticalSection
GetVersionExW
LoadLibraryA
GetProcAddress
FreeLibrary
GetLastError
GetModuleFileNameW
GetCommandLineW
LocalFree
ExitProcess
GetNumberOfConsoleInputEvents
FindCloseChangeNotification
FindFirstChangeNotificationW
GetTempPathW

user32

SetParent
GetDesktopWindow
DestroyCursor
SetCursorPos
CreateIconIndirect
CreateCursor
ChangeClipboardChain
SetClipboardViewer
RegisterWindowMessageW
HideCaret
CreateCaret
SetCaretPos
DestroyCaret
ToUnicode
ToAscii
TrackPopupMenuEx
SetMenuItemInfoW
GetKeyboardState
MapVirtualKeyW
GetMenu
RegisterClipboardFormatW
GetAsyncKeyState
GetClipboardFormatNameW
GetUserObjectInformationW
GetProcessWindowStation
MapWindowPoints
GetWindow
IsWindow
DrawTextA
SetWindowTextA
DialogBoxIndirectParamW
DrawTextW
MsgWaitForMultipleObjects
MessageBeep
WindowFromPoint
GetSystemMenu
EnableMenuItem
SystemParametersInfoW
IsChild
GetFocus
SetWindowsHookExW
UnhookWindowsHookEx
ValidateRgn
UnregisterClassW
RegisterClassW
CreateWindowExW
DefWindowProcW
KillTimer
CallNextHookEx
SetTimer
GetMessageW
CharNextExA
GetWindowPlacement
SetWindowPlacement
IsZoomed
SetWindowTextW
SetWindowRgn
AdjustWindowRectEx
ScrollWindowEx
UpdateWindow
GetClassInfoW
MessageBoxA
GetSystemMetrics
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SetForegroundWindow
EndDialog
MapDialogRect
GetDlgItem
MoveWindow
LoadImageW
GetSysColorBrush
RegisterClassExW
GetWindowRgn
ClipCursor
GetUpdateRect
InvalidateRect
InvalidateRgn
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
GetSysColor
GetCursorPos
SetCapture
GetDoubleClickTime
SetDoubleClickTime
FlashWindowEx
SetCaretBlinkTime
SetWindowPos
GetWindowRect
SendMessageW
LoadIconW
GetWindowLongW
GetClientRect
ReleaseDC
GetWindowDC
GetActiveWindow
GetKeyboardLayout
ActivateKeyboardLayout
GetKeyState
GetKeyboardLayoutList
SendMessageTimeoutW
EnumWindows
EnumChildWindows
GetWindowTextA
GetClassNameA
PostMessageW
SendMessageA
MessageBoxW
PeekMessageW
ReleaseCapture
SetCursor
GetCaretBlinkTime
DestroyWindow
PostThreadMessageW
GetDC
GetIconInfo
DrawIconEx
DestroyIcon
AttachThreadInput
SetFocus
SetWindowLongW
IsIconic
ShowWindow
SetActiveWindow
MsgWaitForMultipleObjectsEx
GetQueueStatus
TranslateMessage
DispatchMessageW
GetShellWindow
FindWindowExW
GetWindowThreadProcessId
IsWindowVisible
GetForegroundWindow
GetParent

gdi32

LineTo
PolyBezierTo
MoveToEx
EndPath
SetPolyFillMode
StartDocW
BeginPath
FillPath
StrokePath
ExtCreatePen
CreateDCW
SelectClipPath
GetObjectA
CloseFigure
SaveDC
StretchBlt
GetStockObject
RealizePalette
SelectPalette
PtInRegion
OffsetRgn
CombineRgn
GetDeviceCaps
GetRegionData
CreateRectRgn
CreateEllipticRgn
RestoreDC
CreateSolidBrush
CreatePen
GetBkMode
StartPage
AbortDoc
EndPage
EndDoc
ResetDCW
GetCharABCWidthsW
GetCharABCWidthsI
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SetGraphicsMode
SetWorldTransform
GetGlyphOutlineW
SetTextColor
SetBkMode
SetTextAlign
ExtTextOutW
GetOutlineTextMetricsW
SelectClipRgn
GdiFlush
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
EnumFontFamiliesExW
GetTextMetricsW
GetTextFaceW
CreateFontIndirectW
GetFontData
CreateCompatibleBitmap
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateBitmap
GetDIBits
GetObjectW

advapi32

DeregisterEventSource
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
InitiateSystemShutdownA
ImpersonateSelf
RevertToSelf
OpenThreadToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextA
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashA
CryptSetHashParam
CryptCreateHash
CryptDecrypt
DuplicateToken
GetUserNameA
LookupAccountSidW
PrivilegeCheck
LookupPrivilegeValueA
RegQueryValueExA
RegOpenKeyExA
GetUserNameW
RegDeleteValueA
RegSetValueExA
EqualSid
RegConnectRegistryA
RegConnectRegistryW
RegCreateKeyExA
ImpersonateLoggedOnUser
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
ReportEventW
RegisterEventSourceW
LogonUserW
ImpersonateNamedPipeClient
OpenSCManagerW
ControlService
StartServiceW
OpenServiceW
CreateServiceW
DeleteService
CreateServiceA
ChangeServiceConfigW
QueryServiceConfigW
QueryServiceConfigA
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
CryptEnumProvidersA
RegisterEventSourceA
ReportEventA
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegFlushKey
CopySid
GetLengthSid

shell32

SHGetFileInfoW
SHChangeNotify
ShellExecuteW
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoGetMalloc
ReleaseStgMedium
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
OleGetClipboard
StringFromGUID2
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleUninitialize
OleInitialize
CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
DoDragDrop
CoTaskMemFree

wsock32

__WSAFDIsSet
shutdown
closesocket
socket
ioctlsocket
htons
connect
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
send
recv
WSASetLastError
setsockopt
listen
getsockname
bind
accept
gethostname
select

imm32

ImmSetCompositionFontW
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContext
ImmGetCompositionStringW
ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

winmm

PlaySoundW

ws2_32

getsockopt
WSASocketW
htonl
WSAAsyncSelect
WSASendTo
WSASend
ntohl
gethostbyaddr
WSAIoctl
WSAAccept
WSARecvFrom
WSARecv
WSANtohl
WSANtohs
WSAConnect
getpeername
WSAHtons
WSAHtonl

psapi

GetProcessMemoryInfo

winspool.drv

GetPrinterW
DeviceCapabilitiesW
OpenPrinterW
EnumFormsW
EnumPrintersW
ClosePrinter

comdlg32

GetSaveFileNameW
GetOpenFileNameW

oleaut32

SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SafeArrayPutElement
SafeArrayCreateVector
SafeArrayDestroy
SysFreeString
SafeArrayGetUBound
SafeArrayGetLBound
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysStringLen
SysAllocString
SafeArrayGetElement

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext

Sections

.text
Size: 23.1MB - Virtual size: 23.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17.3MB - Virtual size: 17.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 251KB - Virtual size: 427KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
crack/RStudio64.exe
.exe windows:5 windows x64 arch:x64

4634b473b3d4e9c35a2aba1d7b07f9ec

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:51:60:d1:6c:97:ef:8c:ed:f0:3c:bc
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

30/03/2021, 12:35

Not After

30/03/2024, 12:35

Subject

SERIALNUMBER=1461834,CN=R-Tools Technology Inc.,OU=R-Tools Technology Inc.,O=R-Tools Technology Inc.,STREET=10520 Yonge St Suite 232,L=Richmond Hill,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c0f6f666669636540722d74742e636f6d,1.3.6.1.4.1.311.60.2.1.2=#13074f6e746172696f,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c1:87:85:6d:ca:8e:10:d0:9b:9e:9c:08:dc:d1:e5:22:5c:18:3c:dc
Signer

Actual PE Digest

c1:87:85:6d:ca:8e:10:d0:9b:9e:9c:08:dc:d1:e5:22:5c:18:3c:dc

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Projects\GIT\DataRecovery\rapps\Batch\RStudioQt.pdb

Imports

mpr

WNetOpenEnumW
WNetAddConnection2A
WNetCancelConnection2W
WNetCancelConnection2A
WNetEnumResourceW
WNetCloseEnum
WNetAddConnection2W

kernel32

DuplicateHandle
OpenFileMappingA
CreateFileMappingA
OpenEventA
ReleaseMutex
WaitForMultipleObjectsEx
CreateSemaphoreA
CreateNamedPipeW
CreateNamedPipeA
ConnectNamedPipe
GetNamedPipeHandleStateW
GetNamedPipeHandleStateA
MultiByteToWideChar
GetVersion
GlobalFree
TerminateThread
GetExitCodeThread
OpenMutexA
CreateEventW
lstrcmpiW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetLocalTime
CreateFileW
CreateFileA
WaitNamedPipeW
WaitNamedPipeA
CreateEventA
DisconnectNamedPipe
ReadFile
SetLastError
WriteFile
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
ReleaseSemaphore
CreateMutexW
VirtualQuery
CreateProcessW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
SetConsoleMode
InitializeCriticalSection
ReadConsoleInputA
WaitForSingleObject
SetEvent
GetLogicalDrives
GetCurrentThreadId
GetFileAttributesW
FormatMessageW
GetExitCodeProcess
TerminateProcess
GetCurrentThread
OpenProcess
GetVersionExW
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetLastError
MapViewOfFile
CloseHandle
CreateMutexA
LocalAlloc
GetLocaleInfoW
GetModuleHandleW
FreeLibrary
SetErrorMode
LoadLibraryA
GetProcAddress
GetVolumeInformationW
GetCurrentProcess
WideCharToMultiByte
DosDateTimeToFileTime
Sleep
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapCompact
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetCommandLineA
GetStartupInfoA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSize
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
FatalAppExitA
SetConsoleCtrlHandler
SetEnvironmentVariableA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetCurrentProcessId
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
InitializeCriticalSectionAndSpinCount
CompareStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CompareStringA
SetEndOfFile
GetProcessHeap
VerifyVersionInfoW
VerSetConditionMask
GetSystemTime
CreateSemaphoreW
QueryPerformanceFrequency
TlsFree
TlsSetValue
SwitchToThread
SetThreadPriority
ResumeThread
GetThreadPriority
TlsGetValue
LoadLibraryExW
GetStartupInfoW
GetModuleFileNameW
OutputDebugStringW
GetSystemDirectoryW
LoadLibraryW
SystemTimeToTzSpecificLocalTime
FindClose
FindFirstFileW
GetFileInformationByHandle
CreateDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
CopyFileW
FindNextChangeNotification
DeleteFileW
GetFullPathNameW
GetTempPathW
DeviceIoControl
GetFileAttributesExW
SetCurrentDirectoryW
SetFilePointerEx
WaitForSingleObjectEx
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultUILanguage
CreatePipe
PeekNamedPipe
FindNextFileW
FindFirstFileExW
ExpandEnvironmentStringsW
GetDriveTypeW
GetUserDefaultLangID
IsValidLanguageGroup
lstrcmpW
GetLongPathNameW
GlobalSize
GetProfileStringW
GetFileSize
GlobalMemoryStatus
FlushConsoleInputBuffer
SystemTimeToFileTime
SetSystemTime
GetModuleHandleA
ReadProcessMemory
GetThreadSelectorEntry
GetThreadContext
SuspendThread
DeleteFileA
GetWindowsDirectoryW
Process32NextW
Process32FirstW
GetSystemDirectoryA
GetVersionExA
FormatMessageA
MoveFileA
RemoveDirectoryA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
SetFileAttributesW
FindNextFileA
FindFirstFileA
SetFileTime
CreateDirectoryA
GetDriveTypeA
GetVolumeInformationA
PulseEvent
GetEnvironmentVariableA
GetTempPathA
GetEnvironmentVariableW
BackupWrite
GetFullPathNameA
BackupSeek
BackupRead
CreateProcessA
SetConsoleTitleA
AllocConsole
VirtualProtect
WriteProcessMemory
lstrcmpiA
LoadLibraryExA
CallNamedPipeA
DefineDosDeviceA
GetDiskFreeSpaceA
SetHandleInformation
ExpandEnvironmentStringsA
lstrlenW
lstrlenA
GetTickCount
LeaveCriticalSection
EnterCriticalSection
VirtualFree
GetSystemInfo
VirtualAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteCriticalSection
GetCommandLineW
LocalFree
ExitProcess
DebugBreak
FindCloseChangeNotification
FindFirstChangeNotificationW
MoveFileW

user32

IsZoomed
SetWindowPlacement
GetWindowPlacement
ValidateRgn
SetParent
GetDesktopWindow
DestroyCursor
SetCursorPos
CreateIconIndirect
CreateCursor
ChangeClipboardChain
SetClipboardViewer
RegisterWindowMessageW
HideCaret
CreateCaret
SetCaretPos
DestroyCaret
ToUnicode
ToAscii
TrackPopupMenuEx
SetMenuItemInfoW
GetKeyboardState
MapVirtualKeyW
GetMenu
RegisterClipboardFormatW
GetAsyncKeyState
GetClipboardFormatNameW
GetUserObjectInformationW
GetProcessWindowStation
MapWindowPoints
GetWindow
IsWindow
DrawTextA
SetWindowTextA
DialogBoxIndirectParamW
DrawTextW
MsgWaitForMultipleObjects
SystemParametersInfoW
GetWindowLongW
SetWindowLongW
IsChild
GetFocus
SetWindowsHookExW
SetWindowTextW
DestroyWindow
UnregisterClassW
RegisterClassW
CreateWindowExW
DefWindowProcW
KillTimer
CallNextHookEx
SetTimer
GetMessageW
CharNextExA
SetWindowRgn
AdjustWindowRectEx
ScrollWindowEx
UpdateWindow
GetClassInfoW
LoadImageW
GetSysColorBrush
RegisterClassExW
GetWindowRgn
MessageBoxA
GetSystemMetrics
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SetForegroundWindow
EndDialog
MapDialogRect
GetDlgItem
MoveWindow
SetWindowPos
ClipCursor
GetUpdateRect
InvalidateRect
InvalidateRgn
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
GetSysColor
GetCursorPos
SetCapture
GetDoubleClickTime
SetDoubleClickTime
SetCaretBlinkTime
ReleaseCapture
EnableMenuItem
SetCursor
GetCaretBlinkTime
FlashWindowEx
GetWindowRect
SendMessageW
LoadIconW
GetWindowLongPtrW
GetClientRect
ReleaseDC
GetWindowDC
GetActiveWindow
GetKeyboardLayout
ActivateKeyboardLayout
GetKeyState
GetKeyboardLayoutList
SendMessageTimeoutW
EnumWindows
EnumChildWindows
GetWindowTextA
GetClassNameA
PostMessageW
SendMessageA
MessageBoxW
PeekMessageW
MessageBeep
WindowFromPoint
GetSystemMenu
UnhookWindowsHookEx
PostThreadMessageW
GetDC
GetIconInfo
DrawIconEx
DestroyIcon
AttachThreadInput
SetFocus
SetWindowLongPtrW
IsIconic
ShowWindow
SetActiveWindow
MsgWaitForMultipleObjectsEx
GetQueueStatus
TranslateMessage
DispatchMessageW
GetShellWindow
FindWindowExW
GetWindowThreadProcessId
IsWindowVisible
GetForegroundWindow
GetParent

gdi32

LineTo
MoveToEx
EndPath
SetPolyFillMode
PolyBezierTo
BeginPath
FillPath
StrokePath
ExtCreatePen
CreateDCW
SelectClipPath
CloseFigure
StartDocW
SaveDC
StretchBlt
RestoreDC
CreateSolidBrush
CreatePen
GetBkMode
StartPage
AbortDoc
EndPage
GetObjectW
ResetDCW
GetCharABCWidthsW
GetCharABCWidthsI
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SetGraphicsMode
SetWorldTransform
GetGlyphOutlineW
SetTextColor
SetBkMode
SetTextAlign
ExtTextOutW
GetOutlineTextMetricsW
SelectClipRgn
GdiFlush
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
EnumFontFamiliesExW
GetTextMetricsW
GetTextFaceW
CreateFontIndirectW
GetFontData
CreateCompatibleBitmap
BitBlt
CreateBitmap
GetDIBits
CreateEllipticRgn
CreateRectRgn
GetRegionData
GetDeviceCaps
CombineRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
OffsetRgn
PtInRegion
SelectPalette
RealizePalette
GetStockObject
EndDoc

advapi32

AllocateAndInitializeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
CryptEnumProvidersW
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextW
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt
DuplicateToken
GetUserNameA
LookupAccountSidW
PrivilegeCheck
LookupPrivilegeValueA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
GetUserNameW
EqualSid
RegConnectRegistryA
RegConnectRegistryW
RegCreateKeyExA
ImpersonateLoggedOnUser
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
LogonUserW
ImpersonateNamedPipeClient
OpenSCManagerW
ControlService
StartServiceW
OpenServiceW
CreateServiceW
DeleteService
CreateServiceA
ChangeServiceConfigW
QueryServiceConfigW
QueryServiceConfigA
RevertToSelf
ImpersonateSelf
InitiateSystemShutdownA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
OpenThreadToken
CopySid
GetLengthSid
RegFlushKey
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW

shell32

SHGetFileInfoW
SHChangeNotify
ShellExecuteW
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoInitializeSecurity
DoDragDrop
ReleaseStgMedium
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
OleGetClipboard
StringFromGUID2
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleUninitialize
OleInitialize
CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
CoGetMalloc
CoTaskMemFree

wsock32

shutdown
closesocket
socket
ioctlsocket
htons
connect
WSACleanup
send
WSAStartup
gethostbyname
select
WSAGetLastError
recv
WSASetLastError
setsockopt
listen
getsockname
bind
accept
gethostname
__WSAFDIsSet

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContext
ImmGetCompositionStringW
ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd
ImmSetCompositionFontW

winmm

PlaySoundW

ws2_32

htonl
WSAAsyncSelect
WSASendTo
WSASend
ntohl
gethostbyaddr
getsockopt
WSAIoctl
WSASocketW
WSAAccept
WSARecvFrom
WSARecv
WSANtohl
WSAConnect
getpeername
WSAHtons
WSAHtonl
WSANtohs

psapi

GetProcessMemoryInfo

winspool.drv

GetPrinterW
DeviceCapabilitiesW
OpenPrinterW
EnumFormsW
EnumPrintersW
ClosePrinter

comdlg32

GetSaveFileNameW
GetOpenFileNameW

oleaut32

SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SafeArrayPutElement
SafeArrayCreateVector
SafeArrayDestroy
SysFreeString
SafeArrayGetUBound
SafeArrayGetLBound
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysStringLen
SysAllocString
SafeArrayGetElement

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext

Sections

.text
Size: 28.3MB - Virtual size: 28.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21.8MB - Virtual size: 21.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 585KB - Virtual size: 799KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
crack/readme.txt
crack/rstudio_register.bat

Sharing

General

Malware Config

Signatures

Files

6160abaf20392b47b0acba564202ea89

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

3c:51:60:d1:6c:97:ef:8c:ed:f0:3c:bcCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

46:89:a8:8d:04:18:38:2a:78:9d:3b:7d:a0:ed:68:2c:2c:2c:31:21Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

kernel32

user32

gdi32

advapi32

shell32

ole32

wsock32

imm32

winmm

ws2_32

psapi

winspool.drv

comdlg32

oleaut32

crypt32

Sections

.text Size: 23.1MB - Virtual size: 23.1MB

.rdata Size: 17.3MB - Virtual size: 17.3MB

.data Size: 251KB - Virtual size: 427KB

.rsrc Size: 80KB - Virtual size: 80KB

4634b473b3d4e9c35a2aba1d7b07f9ec

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

3c:51:60:d1:6c:97:ef:8c:ed:f0:3c:bcCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

c1:87:85:6d:ca:8e:10:d0:9b:9e:9c:08:dc:d1:e5:22:5c:18:3c:dcSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

kernel32

user32

gdi32

advapi32

shell32

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

3c:51:60:d1:6c:97:ef:8c:ed:f0:3c:bc
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

46:89:a8:8d:04:18:38:2a:78:9d:3b:7d:a0:ed:68:2c:2c:2c:31:21
Signer

.text
Size: 23.1MB - Virtual size: 23.1MB

.rdata
Size: 17.3MB - Virtual size: 17.3MB

.data
Size: 251KB - Virtual size: 427KB

.rsrc
Size: 80KB - Virtual size: 80KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

3c:51:60:d1:6c:97:ef:8c:ed:f0:3c:bc
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

c1:87:85:6d:ca:8e:10:d0:9b:9e:9c:08:dc:d1:e5:22:5c:18:3c:dc
Signer

.text
Size: 28.3MB - Virtual size: 28.3MB

.rdata
Size: 21.8MB - Virtual size: 21.8MB

.data
Size: 585KB - Virtual size: 799KB

.pdata
Size: 2.3MB - Virtual size: 2.3MB

.rsrc
Size: 80KB - Virtual size: 80KB