Static task
static1
Behavioral task
behavioral1
Sample
hashcat32.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
hashcat32.exe
Resource
win10v2004-20240508-en
General
-
Target
hashcat32.exe
-
Size
760KB
-
MD5
3d556ed59f63b3f66b835fdef5f60c45
-
SHA1
0002ba9a33cb8e6c093ed4fcde7bef87702a5614
-
SHA256
64a6efed263f71b63de45a1ce976570fb94f495f908788213c754615fed987ae
-
SHA512
cdac7912f23891e9ead5fdf5a94445ead3e8804fefb06bb12d6e4dd1118ad5e65e4242654c6f0613974a2ae2440ea74255ff7d63a276652b1be8fbdd7bf1a59d
-
SSDEEP
12288:m2fgynXoE68/mYSXvMe8fSkmVV8Eoma9um+YViyA6UxlevDK:m2fg+YE68/mYmMe8fSki8EY9um+LyAlF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hashcat32.exe
Files
-
hashcat32.exe.exe windows:4 windows x86 arch:x86
84aac9c5ea048a41a74c8d2a7e52c46e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
kernel32
CreateThread
DeleteCriticalSection
EnterCriticalSection
FlushConsoleInputBuffer
FlushFileBuffers
FreeLibrary
GetACP
GetCPInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetFileAttributesA
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
IsDBCSLeadByteEx
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleWindowInfo
SetProcessAffinityMask
SetThreadAffinityMask
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_atoi64
_cexit
_ctime64
_errno
_filelengthi64
_fileno
_findclose
_findfirst
_fmode
_fstat64
_fullpath
_get_osfhandle
_gmtime64
_initterm
_iob
_lock
_lseeki64
_mkdir
_onexit
_setmode
_stat64
_stricmp
_strnicmp
_time64
exit
fclose
feof
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fscanf
fsetpos
fwrite
getenv
isspace
localeconv
malloc
memcmp
memcpy
memmove
memset
printf
puts
qsort
qsort_s
rand
realloc
rename
rewind
setlocale
setvbuf
signal
sprintf
srand
sscanf
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strstr
_unlock
_write
abort
atoi
tolower
toupper
vfprintf
wcslen
bsearch
calloc
_vsnprintf
_findnext
_unlink
_umask
_strdup
_rmdir
_putenv
_lsearch
_lfind
_getcwd
_fileno
_creat
_close
_chdir
_access
psapi
GetModuleFileNameExA
Sections
.text Size: 577KB - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE