SecuriteInfo[.]com[.]Win32[.]CrypterX-gen[.]13041[.]27911

General

Target
SecuriteInfo.com.Win32.CrypterX-gen.13041.27911
Size 165KB
Sample240708-sse8csvgjr
SHA256 4f0a6b89e63437c52a7adf09a15950b3ba5b9d1d7c8791a8559721ae24875894
MD5 56781772c92e1822beec9faee18fadc9
SHA1 889af8e28ecda1df1e79c1f4abe533959b29a9db
SHA512 7a46f160e3881578c8991ed07a746696738eb994b8f161796ef87081d1d6345927149f168197300750862564b672abaf522db193aa43d980aeef2abd115a460f
SSDEEP 3072:jJLNXOgUQ4IiNpjhmD/Sc11y5Td0Cfq/UVwE7wQWLc:NLNXXUki1mTUmH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Win32.CrypterX-gen.13041.27911

File Explorer

SecuriteInfo.com.Win32.CrypterX-gen.13041.27911

.exe 165KB

SecuriteInfo.com.Win32.CrypterX-gen.13041.27911

IMPHASH 5208417a665309604e7c3226aaaeb5e4
SHA256 4f0a6b89e63437c52a7adf09a15950b3ba5b9d1d7c8791a8559721ae24875894
MD5 56781772c92e1822beec9faee18fadc9
SHA1 889af8e28ecda1df1e79c1f4abe533959b29a9db
SHA512 7a46f160e3881578c8991ed07a746696738eb994b8f161796ef87081d1d6345927149f168197300750862564b672abaf522db193aa43d980aeef2abd115a460f
SSDEEP 3072:jJLNXOgUQ4IiNpjhmD/Sc11y5Td0Cfq/UVwE7wQWLc:NLNXXUki1mTUmH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateJobObjectW SleepEx GetCommProperties GetModuleHandleW GetConsoleAliasesA GlobalAlloc SetVolumeMountPointA lstrcpynW GetModuleFileNameW SetConsoleTitleA ReleaseActCtx SetLastError GetProcAddress BuildCommDCBW GetAtomNameA LoadLibraryA WriteConsoleA UnhandledExceptionFilter InterlockedExchangeAdd SetFileApisToANSI AddAtomA OpenJobObjectW FoldStringW lstrcatW EnumDateFormatsW FindFirstVolumeA LocalFree FlushFileBuffers CloseHandle GetLastError HeapFree MultiByteToWideChar HeapAlloc GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle GetConsoleOutputCP WriteConsoleW HeapSize CreateFileA

user32

GetProcessDefaultLayout

winhttp

WinHttpAddRequestHeaders

Name

.text

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.balowey

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xaci

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rojoj

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win32.CrypterX-gen.13041.27911

kernel32

user32

winhttp

generic