d:\Projects\EgoSecureWork\_bin\Release\CryptionMobile.pdb
Static task
static1
Behavioral task
behavioral1
Sample
CryptionMobile.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
CryptionMobile.exe
Resource
win10v2004-20240508-en
General
-
Target
CryptionMobile.exe
-
Size
5.7MB
-
MD5
2e5dcc68a5060195dc3190fc5e89b2e0
-
SHA1
a79e258730259d16b0baf0992da06f2a25dc8613
-
SHA256
b8881d3d0206018b0b02f84789e3edb63e5e30952e621c062360da38881ab5d3
-
SHA512
4ab74e8f038bed26fbdfa5f8cd68993e949aa781dd86d941c8fb2f2df78189e4b2fe40fd72c6001b273aa1affe43e48999069cfad0309ab7473d95cf6bc79042
-
SSDEEP
98304:m9gwjQSgwQZnfBB+/RCrMCeg0W+WfAKyH7nEVi2dKw09PFlka:hwjcwoffB+FZ7nEVzdo9j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CryptionMobile.exe
Files
-
CryptionMobile.exe.exe windows:5 windows x86 arch:x86
e373b51f96f1d70a6719ca26c09aef3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
CryptDestroyHash
CryptDestroyKey
CryptHashData
CryptGetHashParam
CryptCreateHash
ConvertSidToStringSidA
ConvertSidToStringSidW
CopySid
ConvertStringSidToSidA
ConvertStringSidToSidW
GetTokenInformation
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityInfo
SetSecurityInfo
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegEnumKeyW
RegOpenKeyExW
RegDeleteKeyW
CryptReleaseContext
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptDeriveKey
RegQueryValueExW
CryptExportKey
CryptImportKey
CryptGenRandom
CryptDuplicateKey
CryptGetKeyParam
CryptSetKeyParam
CryptGenKey
CryptGetUserKey
CryptContextAddRef
CryptGetProvParam
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueW
RegOpenKeyW
RegSetValueW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegDeleteValueW
RegSetValueExW
RegSetValueExA
RegCreateKeyExW
RegEnumValueW
RegQueryValueExA
RegEnumKeyExW
RegCreateKeyW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW
kernel32
SetErrorMode
GetStartupInfoW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
ExitThread
CreateThread
HeapReAlloc
ExitProcess
SetConsoleCtrlHandler
GetTimeZoneInformation
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetConsoleCP
SetStdHandle
GetFullPathNameA
GetCurrentDirectoryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetProcessHeap
GetTempFileNameA
GetLocaleInfoA
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
LocalFileTimeToFileTime
FindResourceW
SizeofResource
LockResource
LoadResource
CreateFileW
FindClose
GetLastError
FindNextFileW
FindFirstFileW
GetCurrentThreadId
RaiseException
FormatMessageW
GetProcAddress
LoadLibraryW
SetUnhandledExceptionFilter
GetModuleHandleW
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
CopyFileW
GetTempPathW
GetDriveTypeW
GetCurrentDirectoryW
FileTimeToSystemTime
FileTimeToLocalFileTime
LeaveCriticalSection
EnterCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
InterlockedExchange
GetTempPathA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeLibrary
LocalFree
LocalHandle
SetLastError
GetCurrentProcess
VerifyVersionInfoW
GetProfileIntW
LocalSize
GetPrivateProfileSectionNamesW
lstrcpynW
FindFirstChangeNotificationW
FindNextChangeNotification
FindCloseChangeNotification
OpenProcess
LoadLibraryExW
FlushInstructionCache
lstrcpynA
GetNumberFormatW
lstrcpyW
EnumResourceTypesW
GetExitCodeThread
TerminateThread
CreateDirectoryW
EnumResourceNamesW
VerSetConditionMask
GetVersionExW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
SetThreadLocale
GetDiskFreeSpaceW
CloseHandle
WriteFile
ReadFile
GetFileSize
lstrlenA
DeviceIoControl
GetDriveTypeA
CreateFileA
GetLocalTime
GetComputerNameExA
CreateDirectoryA
SetFileAttributesA
RemoveDirectoryA
GetTickCount
InterlockedDecrement
SetFilePointer
SetEndOfFile
GetFileAttributesA
GetUserDefaultLangID
SetFilePointerEx
GetFileSizeEx
FlushFileBuffers
GetCurrentProcessId
DeleteFileA
FindNextFileA
SystemTimeToFileTime
FindFirstFileA
GetOverlappedResult
SetNamedPipeHandleState
ConnectNamedPipe
CreateNamedPipeW
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
QueryPerformanceCounter
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
GetThreadTimes
GetCurrentThread
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetModuleFileNameW
MulDiv
GlobalSize
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
SetFileTime
GetFileTime
GetTempFileNameW
GetFullPathNameW
GlobalGetAtomNameW
GlobalFlags
LocalAlloc
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetThreadLocale
MoveFileW
GetStringTypeExW
Sleep
CompareFileTime
CreateEventA
SetEvent
ResetEvent
PulseEvent
InitializeCriticalSection
DeleteCriticalSection
CreateMutexA
WaitForSingleObject
ReleaseMutex
CreateSemaphoreA
ReleaseSemaphore
SuspendThread
ResumeThread
SetThreadPriority
CreateEventW
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
InterlockedCompareExchange
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
InterlockedIncrement
CreateSemaphoreW
InterlockedExchangeAdd
CreateIoCompletionPort
WaitForMultipleObjects
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
CreateTimerQueueTimer
IsBadReadPtr
LoadLibraryA
UnmapViewOfFile
MapViewOfFile
GetFileAttributesExW
GetShortPathNameW
GetVolumeInformationW
DuplicateHandle
UnlockFile
LockFile
lstrcmpiW
CreateFileMappingW
user32
BringWindowToTop
TranslateAcceleratorW
RegisterClipboardFormatW
SetWindowContextHelpId
CallWindowProcW
GetWindowLongW
AppendMenuW
CheckMenuItem
GetSysColorBrush
UnregisterClassW
DeleteMenu
DestroyIcon
SetRectEmpty
CharNextW
IsRectEmpty
SetRect
CopyAcceleratorTableW
InvalidateRgn
SetCapture
GetNextDlgGroupItem
MessageBeep
PostThreadMessageW
GetSystemMenu
SetParent
MapDialogRect
ShowOwnedPopups
LoadAcceleratorsW
ReleaseCapture
ReuseDDElParam
UnpackDDElParam
GetKeyNameTextW
MapVirtualKeyW
SystemParametersInfoW
CharUpperW
GetDialogBaseUnits
EnableWindow
GetMessageW
RegisterWindowMessageW
OffsetRect
FillRect
GetWindowRect
GetSubMenu
ClientToScreen
ScreenToClient
GetSysColor
InvalidateRect
UpdateLayeredWindow
CopyRect
UpdateWindow
SetForegroundWindow
SendMessageW
PostMessageW
SetCursor
PtInRect
UnionRect
SetTimer
KillTimer
SetWindowRgn
GetClientRect
RedrawWindow
LoadCursorW
GetFocus
IsWindow
GetParent
InsertMenuItemW
RemoveMenu
GetMenuStringW
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
DestroyMenu
TrackPopupMenu
SetWindowLongW
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
InflateRect
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringW
WindowFromPoint
DrawTextW
TabbedTextOutW
InsertMenuW
GetWindowThreadProcessId
LoadMenuW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetLayeredWindowAttributes
IsCharUpperW
IsCharLowerW
IsCharAlphaW
IsCharAlphaNumericW
CharUpperA
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
TranslateMDISysAccel
DrawMenuBar
DefFrameProcW
GetTabbedTextExtentA
GetDoubleClickTime
SetCursorPos
GetCursor
SetMenuDefaultItem
SetClassLongW
CreatePopupMenu
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
DrawEdge
SendMessageTimeoutW
GetMenuItemRect
IsWindowUnicode
GetWindowLongA
SetWindowLongA
LookupIconIdFromDirectoryEx
LoadStringW
IsClipboardFormatAvailable
GetKeyboardLayout
MapVirtualKeyExW
GetKeyboardLayoutList
GetKeyboardState
ToUnicodeEx
GetMenuDefaultItem
InvertRect
HideCaret
ShowCaret
IsMenu
GetWindowRgn
WaitMessage
OpenInputDesktop
CloseDesktop
IsZoomed
wsprintfW
EnumWindows
DrawFocusRect
DrawFrameControl
DrawIconEx
LoadImageW
CreateIconIndirect
CreateIconFromResourceEx
CopyIcon
GetDCEx
LockWindowUpdate
DrawTextExW
GetIconInfo
DrawStateW
PeekMessageW
MapWindowPoints
MessageBoxA
EndDialog
GetKeyState
SetMenu
GetScrollPos
IsWindowVisible
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
GetDlgCtrlID
DefWindowProcW
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
gdi32
Ellipse
StrokePath
FillPath
StrokeAndFillPath
EndPath
CloseFigure
BeginPath
CreatePolygonRgn
StretchBlt
CreatePalette
CreateDIBitmap
SetPixel
GetDIBits
Polygon
GetCurrentObject
GetTextAlign
PtInRegion
EnumFontFamiliesExW
ExtCreateRegion
Polyline
OffsetRgn
GetTextCharsetInfo
SetBrushOrgEx
Rectangle
GetViewportOrgEx
RoundRect
GetTextExtentPoint32A
GetWindowOrgEx
GetRgnBox
GetTextColor
GetBkColor
GetTextMetricsW
GetTextExtentPoint32W
StretchDIBits
CreateFontW
GetCharWidthW
DPtoLP
PatBlt
GetMapMode
CombineRgn
CreateRectRgnIndirect
CreateFontIndirectW
CreatePen
GetObjectType
SelectPalette
GetStockObject
CreatePatternBrush
ExtSelectClipRgn
PolyBezierTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
GetClipRgn
SelectClipRgn
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CopyMetaFileW
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
GetObjectA
BitBlt
GetBitmapBits
GetObjectW
DeleteDC
CreateCompatibleDC
SetDIBColorTable
CreateDIBSection
SelectObject
DeleteObject
CreateSolidBrush
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
shell32
ShellExecuteExW
SHAppBarMessage
DragAcceptFiles
ExtractIconW
DragQueryFileW
DragFinish
SHGetFolderPathW
SHCreateDirectoryExW
SHGetFolderPathA
SHGetMalloc
SHCreateDirectoryExA
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFileInfoW
SHFileOperationW
ShellExecuteW
comctl32
InitCommonControlsEx
ImageList_DrawIndirect
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy
ImageList_GetImageInfo
ImageList_AddMasked
ImageList_Create
ImageList_Draw
_TrackMouseEvent
FlatSB_GetScrollProp
ImageList_GetBkColor
shlwapi
PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathFileExistsA
StrRetToStrW
PathFileExistsW
PathRemoveFileSpecW
oledlg
OleUIAddVerbMenuW
OleUIBusyW
ole32
CoInitializeEx
CoUninitialize
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoCreateInstance
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
DoDragDrop
oleaut32
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
LoadTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
VariantCopy
VarUdateFromDate
SafeArrayDestroy
VarDateFromStr
VarBstrFromDate
OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
OleLoadPicturePath
VariantChangeTypeEx
ws2_32
WSAGetLastError
WSACreateEvent
WSACloseEvent
WSAEventSelect
gethostname
connect
htons
inet_addr
inet_ntoa
gethostbyname
bind
htonl
setsockopt
socket
listen
accept
send
recv
select
closesocket
shutdown
WSAResetEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
ioctlsocket
WSASetLastError
WSACleanup
WSAStartup
WSAIoctl
WSASocketW
crypt32
CertCloseStore
CryptAcquireCertificatePrivateKey
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObject
CertFindCertificateInStore
CertOpenStore
CertDeleteCertificateFromStore
CertVerifySubjectCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertAddCertificateContextToStore
PFXImportCertStore
PFXIsPFXBlob
CertFreeCertificateContext
gdiplus
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipFree
GdipDeleteBrush
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreateFromHDC
GdipSetCompositingMode
GdipSetCompositingQuality
GdipFillRectangle
GdipDrawString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneBrush
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
dbghelp
ImageDirectoryEntryToData
mpr
WNetCancelConnection2A
WNetAddConnection2A
winmm
PlaySoundW
Sections
.text Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 971KB - Virtual size: 970KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 101KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ