CrystalUI[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CrystalUI.exe
Size

103KB
MD5

722e1496fd28cfa542159850f5f5cae2
SHA1

4ea70d171eb2d50b8efd3de46b22b6667e018890
SHA256

f6e654d8c222e3c92478d9f2ce6b7182451ba735cef8b24ab63bebc6b072c8b1
SHA512

979f26ae3d75afc631cdb029f6cf8a7a046e9ad03732041cbef3a5091f10f2ebf1316471cd07b13651366db708f1f0090e8418dcc811292b44e019182ab43e71
SSDEEP

3072:dQoGeEx/ZonlVq15rBKKQUy/SXoph+ll+:moGPnolI7rYf/SXophM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CrystalUI.exe

Files

CrystalUI.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

=X"eZ^
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ