VMware[.]WS17[.]FS13[.]Keygen-BTCR[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

VMware.WS17.FS13.Keygen-BTCR.7z
Size

1.0MB
MD5

3550006dbba5e799edcf5510518e068c
SHA1

ff42c17a9d504778991640d07a6a51415be27f01
SHA256

d21d09dabfbc7c2727cd4930d7b11eb4133688eb81409787f04f6480cb2760dd
SHA512

7758d02beaa1f499b288a395b2722a6b6e0df9995bf2020a90587c485d835014537d3f16a6c06b604f35ae862f5613dda2345b3c45aa78fe311ce7945ef6d636
SSDEEP

24576:Sid1I+eqh4AE9k8u3fGA/uZxwOATXwFO4oy+kv9vn:VM+eqqfkpwwPwO4oS1f

Score

3^/10

qr link

Malware Config

Signatures

One or more HTTP URLs in qr code identified
Detects presence of HTTP links in QR codes.
qr link

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/VMware.Workstation.Pro.v17.Keygen-BTCR/BTCR/Keygen.exe

Files

VMware.WS17.FS13.Keygen-BTCR.7z
.7z
CRACKSurl.txt
Download More.url
.url
Join Telegram for more.url
.url
Scan QR.png
.png
- https://t.me/cracksurldotcom
VMware.Fusion.Professional.v13.MacOS.Keygen-BTCR/BTCR/Keygen.zip
.app macos
VMware.Fusion.Professional.v13.MacOS.Keygen-BTCR/btcr.nfo
VMware.Fusion.Professional.v13.MacOS.Keygen-BTCR/file_id.diz
VMware.Workstation.Pro.v17.Keygen-BTCR/BTCR/Keygen.exe
.exe windows:4 windows x86 arch:x86

32a31fbc8bf28db3ee1293055ab37840

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA

user32

IsWindowEnabled

advapi32

RegOpenKeyExA

comctl32

ImageList_Create

Sections

.pdata
Size: - Virtual size: 1.1MB

IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 102KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VMware.Workstation.Pro.v17.Keygen-BTCR/btcr.nfo
VMware.Workstation.Pro.v17.Keygen-BTCR/file_id.diz
VMware.Workstation.Pro.v17.Linux.Keygen-BTCR/BTCR/Keygen
.elf linux x64
VMware.Workstation.Pro.v17.Linux.Keygen-BTCR/BTCR/Read Me.txt
VMware.Workstation.Pro.v17.Linux.Keygen-BTCR/btcr.nfo
VMware.Workstation.Pro.v17.Linux.Keygen-BTCR/file_id.diz