Static task
static1
Behavioral task
behavioral1
Sample
crystallite_v1.rar.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
crystallite_v1.rar.exe
Resource
win10v2004-20240508-en
General
-
Target
804578d11501a8850c89965f9f8ddbdf_JaffaCakes118
-
Size
2.2MB
-
MD5
804578d11501a8850c89965f9f8ddbdf
-
SHA1
22c06b1d586483dc9245dd51012f36ff7d43611c
-
SHA256
68dab24efbffc08ef61f88e24c6b3b7cd55ccd3aaa661f70bba9ed74df1dacad
-
SHA512
05ef673254a27de281d632a60dcb19d3e26022bd1b4dc769954d6961a94c8e856b96527cb159fa934ff5800b6b4e46a70fa32c1a2eab3006811fe7b441385ec4
-
SSDEEP
49152:SOaurMVO+1+8QxHZJ+FdBpLYONtMrm1owdFLXsSN3Gye:Hauok+Qrx7+FPyON2sdlXjE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/crystallite_v1.rar.exe
Files
-
804578d11501a8850c89965f9f8ddbdf_JaffaCakes118.rar
-
crystallite_v1.rar.exe.exe windows:4 windows x86 arch:x86
2b4fdf658a11b2057309ac80efb3a3d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
wintrust
CryptCATOpen
WTHelperOpenKnownStores
WVTAsn1SpcFinancialCriteriaInfoEncode
WVTAsn1SpcStatementTypeEncode
CryptCATGetMemberInfo
TrustFreeDecode
CryptCATCatalogInfoFromContext
WVTAsn1SpcSigInfoDecode
CryptSIPCreateIndirectData
CryptCATCDFEnumMembers
mssip32DllUnregisterServer
WintrustAddDefaultForUsage
WVTAsn1CatNameValueDecode
CryptCATPutAttrInfo
CryptCATCDFOpen
WVTAsn1SpcFinancialCriteriaInfoDecode
WTHelperGetAgencyInfo
CatalogCompactHashDatabase
SoftpubLoadDefUsageCallData
DriverCleanupPolicy
WTHelperProvDataFromStateData
WintrustCertificateTrust
SoftpubDefCertInit
OfficeCleanupPolicy
TrustDecode
DllRegisterServer
WVTAsn1CatMemberInfoEncode
CryptCATPutMemberInfo
DriverInitializePolicy
WTHelperGetFileName
WVTAsn1SpcSigInfoEncode
SoftpubLoadSignature
WTHelperGetProvPrivateDataFromChain
MsCatFreeHashTag
CryptCATCDFEnumCatAttributes
WintrustGetRegPolicyFlags
DriverFinalPolicy
WVTAsn1SpcPeImageDataEncode
mciwave
DriverProc
mscms
InternalGetPS2ColorSpaceArray
InstallColorProfileA
InternalGetPS2CSAFromLCS
SetStandardColorSpaceProfileA
SetColorProfileElement
SetColorProfileHeader
TranslateBitmapBits
UninstallColorProfileA
IsColorProfileValid
GetNamedProfileInfo
OpenColorProfileW
CloseColorProfile
InternalGetPS2ColorRenderingDictionary
OpenColorProfileA
RegisterCMMA
GetPS2ColorRenderingDictionary
SelectCMM
EnumColorProfilesW
CreateColorTransformA
GetPS2ColorRenderingIntent
UnregisterCMMW
AssociateColorProfileWithDeviceA
GetCMMInfo
DisassociateColorProfileFromDeviceA
InternalGetPS2PreviewCRD
TranslateColors
EnumColorProfilesA
InternalGetDeviceConfig
GetColorProfileFromHandle
GetColorProfileHeader
InstallColorProfileW
GetColorDirectoryW
GetColorDirectoryA
CreateColorTransformW
UnregisterCMMA
DisassociateColorProfileFromDeviceW
DeleteColorTransform
GenerateCopyFilePaths
UninstallColorProfileW
GetStandardColorSpaceProfileW
certcli
CACountCertTypes
CAFindByIssuerDN
CAEnumCertTypes
CAFreeCertTypeExtensions
CACreateCertType
CAGetCertTypeProperty
CASetCertTypeProperty
CASetCertTypeFlags
CAAddCACertificateType
CAEnumNextCA
CASetCACertificate
CASetCAFlags
CAFindByCertType
iassvcs
IASAllocateUniqueID
DllRegisterServer
IASAdler32
DllGetClassObject
IASRadiusCrypt
IASInitialize
IASSetMaxNumberOfThreads
IASSetMaxThreadIdle
IASReportEvent
IASUninitialize
IASRegisterComponent
IASRequestThread
DllCanUnloadNow
IASVariantChangeType
DllUnregisterServer
pdh
PdhGetCounterInfoW
PdhUpdateLogFileCatalog
PdhGetFormattedCounterArrayA
PdhVbGetOneCounterPath
PdhVbOpenQuery
PdhIsRealTimeQuery
PdhEnumMachinesA
PdhGetDllVersion
PdhOpenQuery
PdhGetRawCounterValue
PdhVbGetLogFileSize
PdhBrowseCountersA
PdhCalculateCounterFromRawValue
PdhCollectQueryDataEx
PdhExpandWildCardPathW
PdhEnumObjectsA
PdhGetDefaultPerfObjectW
PdhExpandWildCardPathA
PdhSelectDataSourceA
PdhReadRawLogRecord
PdhLookupPerfIndexByNameW
PdhVbAddCounter
PdhVbGetCounterPathFromList
PdhAddCounterA
PdhFormatFromRawValue
PdhValidatePathW
PdhListLogFileHeaderW
PdhGetLogFileSize
PdhUpdateLogW
PdhGetDataSourceTimeRangeW
PdhExpandCounterPathA
PdhSetDefaultRealTimeDataSource
deskadp
DllGetClassObject
DllCanUnloadNow
stclient
DllCanUnloadNow
DllGetClassObject
DllUnregisterServer
DllRegisterServer
kernel32
FillConsoleOutputCharacterA
VerifyConsoleIoHandle
GlobalFindAtomA
SetCalendarInfoA
CloseHandle
GetLastError
Process32FirstW
AddConsoleAliasW
GetVolumePathNameA
WriteConsoleInputVDMW
GetProcessWorkingSetSize
BuildCommDCBAndTimeoutsW
FreeLibraryAndExitThread
QueryPerformanceCounter
Beep
RegisterWowBaseHandlers
GetModuleFileNameA
FindNextFileA
GetConsoleWindow
FreeLibrary
GetThreadTimes
OpenFileMappingW
SetCommConfig
Process32Next
SetThreadPriority
DisableThreadLibraryCalls
WriteConsoleInputA
CreateMailslotA
QueueUserWorkItem
ProcessIdToSessionId
GetFullPathNameW
GetConsoleDisplayMode
VirtualAlloc
FindNextVolumeA
ResumeThread
OpenSemaphoreW
CompareStringW
DeleteFiber
CreateDirectoryExA
HeapSummary
GetConsoleScreenBufferInfo
CommConfigDialogA
ReadConsoleOutputA
EnumCalendarInfoExA
SetHandleCount
EnumLanguageGroupLocalesW
_hread
HeapLock
SetConsoleNlsMode
MapUserPhysicalPages
GetFileType
GetConsoleInputExeNameA
docprop
DllCanUnloadNow
DllGetClassObject
msoert2
FMissingCert
PszScanToCharA
HrStreamSeekCur
CryptAllocFunc
OpenFileStream
HrIndexOfWeek
CreateSystemHandleName
WriteStreamToFileHandle
PszSkipWhiteW
PszDupW
HrCopyStream
HrLPSZCPToBSTR
WriteStreamToFileW
PVGetCertificateParam
IsPrint
HrIndexOfMonth
FIsEmptyW
IsValidFileIfFileUrlW
PszAllocA
OpenFileStreamWithFlagsW
PszEscapeMenuStringA
HrGetStreamPos
FIsSpaceW
FIsEmptyA
CreateLogFile
CrackNotificationPackage
IsDigit
HrCopyStreamCB
CreateTempFileStream
OpenFileStreamShareW
PszDayFromIndex
GetDllMajorVersion
HrFindInetTimeZone
IsUpper
ReplaceCharsW
CreateDataObject
CreateTempFile
HrGetElementImpl
dinput
DirectInputCreateW
DllGetClassObject
DllCanUnloadNow
DllUnregisterServer
DirectInputCreateEx
DllRegisterServer
DirectInputCreateA
ntmarta
AccRewriteSetEntriesInAcl
AccProvHandleRevokeAccessRights
AccProvGetOperationResults
AccProvSetAccessRights
EventGuidToName
AccConvertAccessToSecurityDescriptor
AccRewriteGetHandleRights
AccSetEntriesInAList
AccProvHandleGetAllRights
AccProvRevokeAuditRights
AccProvIsAccessAudited
AccLookupAccountTrustee
AccLookupAccountSid
AccProvCancelOperation
AccProvIsObjectAccessible
AccProvGetAccessInfoPerObjectType
AccRewriteSetHandleRights
AccGetAccessForTrustee
AccProvGrantAccessRights
AccProvGetCapabilities
AccConvertAccessToSD
AccLookupAccountName
AccProvHandleIsAccessAudited
AccRewriteGetNamedRights
AccProvHandleGetAccessInfoPerObjectType
AccProvGetTrusteesAccess
AccProvHandleGetTrusteesAccess
AccProvHandleSetAccessRights
AccRewriteGetExplicitEntriesFromAcl
AccProvHandleRevokeAuditRights
AccProvHandleGrantAccessRights
AccConvertSDToAccess
AccConvertAccessMaskToActrlAccess
AccProvHandleIsObjectAccessible
EventNameFree
AccRewriteSetNamedRights
AccConvertAclToAccess
AccProvGetAllRights
ws2help
WahCloseApcHelper
WahWaitForNotification
WahCreateHandleContextTable
WahCreateSocketHandle
WahOpenApcHelper
WahCloseHandleHelper
WahNotifyAllProcesses
WahEnableNonIFSHandleSupport
WahQueueUserApc
WahDisableNonIFSHandleSupport
WahOpenHandleHelper
WahDestroyHandleContextTable
WahRemoveHandleContext
WahCompleteRequest
WahCreateNotificationHandle
WahOpenNotificationHandleHelper
WahCloseSocketHandle
advpack
GetVersionFromFile
sqlwoa
newMultiByteFromWideChar
ConvertMultiSZNameToW
newMultiByteFromWideCharEx
newMultiByteFromWideCharSize
newWideCharFromMultiByte
AllocConvertMultiSZNameToA
_tsystem
_trename
_tfopen
cliconfg
ClientConfigureAddEdit
OnInitDialogMain
CPlApplet
msvcp60
_Toupper
Sections
.data Size: - Virtual size: 14.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 602KB - Virtual size: 602KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE