crypter[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

crypter.zip
Size

740KB
MD5

c3569bd8325627c7b76f415757002dc4
SHA1

0cb4cf72598336054795bbb835c11d302f507ba1
SHA256

e91f3e92c2486d8ae2737249d6fbb179a8eed0f914c91e657c5a7c905ccc7372
SHA512

5d90a14cc9de5af81eddfe126c51f9d5fe3fd9f31aa18de523b63801155ce841f485a4d200dfdf186e6b7f85bb00e6ccbede0f5944767b75682c9dd9368d1355
SSDEEP

12288:uGmXlFh6AIo+c4aemSPcuSobq9voexlMaNozCUNxyx7hq09ezI0W:ZmD6Aoc4OS0Do+9vflMaN6Nw7hWkB

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Rw.exe
unpack001/crypter.exe

Files

crypter.zip
.zip
Rw.exe
.exe windows:6 windows x64 arch:x64

b21791f930903774bcfcdd54863c781c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\pc\Desktop\Cpp Grabber\Rw\x64\Release\Rw.pdb

Imports

shlwapi

PathStripPathA

kernel32

RtlLookupFunctionEntry
GetModuleFileNameA
FindFirstFileA
GetDriveTypeA
FindNextFileA
FindClose
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetModuleHandleW
RtlCaptureContext
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId

vcruntime140

__C_specific_handler
strrchr
__current_exception
__current_exception_context
memset
memcpy

api-ms-win-crt-stdio-l1-1-0

fread
__p__commode
ftell
__stdio_common_vsprintf
fwrite
rewind
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
fseek
fclose
fopen

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
perror
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-filesystem-l1-1-0

rename

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypter.exe
.exe windows:6 windows x64 arch:x64

c2d457ad8ac36fc9f18d45bffcd450c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler

Sections

.text
Size: 648KB - Virtual size: 647KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 876KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 603KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b21791f930903774bcfcdd54863c781c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 9KB

.pdata Size: 512B - Virtual size: 468B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 48B

c2d457ad8ac36fc9f18d45bffcd450c2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 648KB - Virtual size: 647KB

.rdata Size: 876KB - Virtual size: 876KB

.data Size: 56KB - Virtual size: 603KB

.pdata Size: 18KB - Virtual size: 18KB

.xdata Size: 512B - Virtual size: 180B

.idata Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 12KB

.symtab Size: 512B - Virtual size: 4B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 9KB

.pdata
Size: 512B - Virtual size: 468B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 48B

.text
Size: 648KB - Virtual size: 647KB

.rdata
Size: 876KB - Virtual size: 876KB

.data
Size: 56KB - Virtual size: 603KB

.pdata
Size: 18KB - Virtual size: 18KB

.xdata
Size: 512B - Virtual size: 180B

.idata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB

.symtab
Size: 512B - Virtual size: 4B