D:\Codes\Crasheye\x64\Release\CrasheyeReport64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5b022507dfc93da487ade0c9c3124731a3433f32dcb8158ddb14b9cb495e5879.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5b022507dfc93da487ade0c9c3124731a3433f32dcb8158ddb14b9cb495e5879.exe
Resource
win10v2004-20240412-en
General
-
Target
5b022507dfc93da487ade0c9c3124731a3433f32dcb8158ddb14b9cb495e5879
-
Size
4.8MB
-
MD5
aa1cabae9f19f25ec76376426255e1dd
-
SHA1
b07ce157d61b59e7393aa069150436558853220d
-
SHA256
5b022507dfc93da487ade0c9c3124731a3433f32dcb8158ddb14b9cb495e5879
-
SHA512
24b5273fb906894582b749553939675e608cec0bf994203df089b3f53251e50292e327a6b044a3cff02026983af6ae6665ae03c4ce9ae94c3eaea7eb03955a9a
-
SSDEEP
49152:bHKOCqSWW+4sTAqTj0ACNqOD5hOId3VuHu8PeiUUJ6CnUbeydKFcqao+iXYqYxES:b0WmkO8p1moyqYxt1cCFyDm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b022507dfc93da487ade0c9c3124731a3433f32dcb8158ddb14b9cb495e5879
Files
-
5b022507dfc93da487ade0c9c3124731a3433f32dcb8158ddb14b9cb495e5879.exe windows:6 windows x64 arch:x64
1b971e5aadb7ab6b7206f59b4deb4be4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetCommandLineW
LocalFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
DeleteFileW
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
GetCurrentDirectoryW
GetProcAddress
GetModuleHandleW
CreateFileW
UnmapViewOfFile
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
GetFileInformationByHandle
GetFileSize
SetFilePointer
ReadFile
WriteFile
GetLocalTime
SystemTimeToFileTime
GetTickCount
GetStartupInfoW
CreateProcessW
CloseHandle
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetFileInformationByHandleEx
SetFilePointerEx
AcquireSRWLockExclusive
GetUserDefaultLangID
SwitchToThread
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
TryAcquireSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
WakeAllConditionVariable
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetFullPathNameW
CreateThread
SetThreadStackGuarantee
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetHandleInformation
SleepConditionVariableSRW
WakeConditionVariable
PostQueuedCompletionStatus
GetFileAttributesW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetProcessHeap
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent
HeapSize
HeapReAlloc
Process32NextW
HeapFree
HeapAlloc
HeapDestroy
GetModuleFileNameW
DeleteCriticalSection
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
Sleep
ReleaseSRWLockExclusive
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
GetLastError
GetSystemTimeAsFileTime
RaiseException
user32
DialogBoxParamW
GetDlgItem
GetSysColor
SendMessageW
SetWindowTextW
EnumWindows
GetWindowThreadProcessId
LoadBitmapW
SetWindowPos
LoadStringW
GetWindowTextW
GetDesktopWindow
CallWindowProcW
SetWindowLongPtrW
MessageBoxW
CheckRadioButton
ShowWindow
EndDialog
gdi32
CreateSolidBrush
DeleteObject
CreateFontW
SetTextColor
SelectObject
advapi32
RegCloseKey
RegOpenKeyExW
SystemFunction036
RegQueryValueExW
shell32
ShellExecuteW
CommandLineToArgvW
msvcp140
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
shlwapi
PathCombineW
PathIsDirectoryW
PathFindFileNameW
PathFileExistsW
wininet
InternetConnectW
HttpAddRequestHeadersW
HttpQueryInfoW
InternetOpenW
InternetQueryDataAvailable
InternetCrackUrlW
HttpOpenRequestW
InternetCloseHandle
HttpSendRequestW
InternetReadFile
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
psapi
GetProcessMemoryInfo
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertOpenStore
CertDuplicateStore
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
secur32
FreeContextBuffer
DeleteSecurityContext
AcceptSecurityContext
EncryptMessage
QueryContextAttributesW
ApplyControlToken
InitializeSecurityContextW
DecryptMessage
FreeCredentialsHandle
AcquireCredentialsHandleA
ntdll
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
RtlVirtualUnwind
bcrypt
BCryptGenRandom
ws2_32
send
recv
getsockname
freeaddrinfo
getaddrinfo
shutdown
WSASend
getsockopt
getpeername
bind
WSAIoctl
setsockopt
ioctlsocket
WSASocketW
closesocket
WSAGetLastError
connect
WSACleanup
WSAStartup
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
__std_exception_destroy
_purecall
wcschr
strchr
__CxxFrameHandler3
memcpy
memmove
memcmp
memset
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
wcsrchr
api-ms-win-crt-stdio-l1-1-0
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
_get_stream_buffer_pointers
__stdio_common_vswprintf
__stdio_common_vsprintf
fwrite
__acrt_iob_func
__stdio_common_vfwprintf
ferror
__stdio_common_vsnprintf_s
fgetc
__p__commode
_close
_wsopen_s
fputs
fflush
_set_fmode
_write
__stdio_common_vswprintf_s
__stdio_common_vswscanf
fputc
__stdio_common_vfprintf
fread
fseek
ftell
fclose
_wfopen_s
_putws
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
_get_wide_winmain_command_line
_set_app_type
_seh_filter_exe
_errno
exit
_initterm
_crt_atexit
_invalid_parameter_noinfo
_wcserror
_initialize_wide_environment
_initterm_e
_register_onexit_function
_initialize_onexit_table
terminate
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_cexit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-convert-l1-1-0
wcstol
_itow_s
_wtoi
api-ms-win-crt-string-l1-1-0
wmemcpy_s
wcsnlen
strncmp
isalnum
isalpha
_wcsicmp
tolower
isspace
_wcsnicmp
strlen
toupper
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_wmkdir
_wfindfirst64i32
_wfullpath
_unlock_file
_wfindnext64i32
_findclose
_lock_file
api-ms-win-crt-environment-l1-1-0
_wgetcwd
_wgetenv
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ