eulen_cracked[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

eulen_cracked.rar
Size

7.0MB
MD5

a9aca749d7d3bc2b499695827f604009
SHA1

cc618621f50d1895fd267c5bc5db8d0f21275175
SHA256

190959ff5dcaff83447115bd1439381c5db9c60cf6b7fe3accfc6995901d4fa8
SHA512

2cea51f6e69978d4a7d6a495100cab1683aeb3906891780980b613f875f910147b7dc603c052b4b70ee747d8996e4b6af33ad725119f545dc952195290c9b232
SSDEEP

196608:MWzIXZw6STl1Q3YFHxME+TbVzVzERkWyPicviKT:TIJHWhFH2EabVtEwicviG

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Injector.exe
unpack001/loader.exe
unpack001/rip.dll

Files

eulen_cracked.rar
.rar
Injector.exe
.exe windows:6 windows x64 arch:x64

53f2f6f7e9adb9982c4c6aa2138e5b38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAllocEx
CreateRemoteThread
SetConsoleTitleA
GetCurrentProcess
OpenProcess
GetProcAddress
CreateProcessA
FindClose
CloseHandle
LoadLibraryA
Sleep
WriteProcessMemory
GetLocaleInfoEx
FormatMessageA
LocalFree
FindFirstFileExW
FindNextFileW
AreFileApisANSI
GetLastError
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
__std_terminate
memmove
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
memcmp

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argc
exit
_exit
_initterm_e
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_register_onexit_function
_crt_atexit
terminate
__p___argv
_invalid_parameter_noinfo_noreturn
_get_initial_narrow_environment

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
_getcwd

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
loader.exe
.exe windows:6 windows x64 arch:x64

6ec7f59e25f7f05072ebc48fc539694a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateProcessA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

RegisterClassExW

gdi32

DeleteDC

advapi32

RegDeleteKeyA

shell32

SHGetKnownFolderPath

ole32

CoCreateGuid

oleaut32

VariantClear

ntdll

NtResumeThread

msvcp140

??1_Lockit@std@@QEAA@XZ

shlwapi

PathFindExtensionW

ws2_32

closesocket

crypt32

CertOpenStore

secur32

InitSecurityInterfaceW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow

gdiplus

GdiplusShutdown

dnsapi

DnsNameCompare_W

rpcrt4

UuidCreate

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-stdio-l1-1-0

fsetpos

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

_itow_s

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Sections

🧠<'0P
Size: - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

🧠_qT(
Size: - Virtual size: 589KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

🧠GhQ5
Size: - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

🧠=`9>
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

🧠Bz:!
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

🧠r>he
Size: - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

🧠].E5
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

🧠2ea&
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

🧠.$3G
Size: 1024B - Virtual size: 737B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
rip.dll
.dll windows:6 windows x64 arch:x64

0fb696af733010bba6bae81be7ec2f21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleHandleA
VirtualProtect
AcquireSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
ReleaseSRWLockExclusive

user32

MessageBoxA

msvcp140

_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_detach

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
__std_type_info_destroy_list
memset
__std_exception_destroy
__std_exception_copy
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
memmove

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
exit
_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table
terminate
system
_register_onexit_function
_beginthreadex

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53f2f6f7e9adb9982c4c6aa2138e5b38

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 172B

6ec7f59e25f7f05072ebc48fc539694a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

msvcp140

shlwapi

ws2_32

crypt32

secur32

d3d11

d3dcompiler_47

imm32

gdiplus

dnsapi

rpcrt4

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

🧠<'0P Size: - Virtual size: 508KB

🧠_qT( Size: - Virtual size: 589KB

🧠GhQ5 Size: - Virtual size: 787KB

🧠=`9> Size: - Virtual size: 21KB

🧠Bz:! Size: - Virtual size: 8KB

🧠r>he Size: - Virtual size: 5.3MB

🧠].E5 Size: 6KB - Virtual size: 5KB

🧠2ea& Size: 7.3MB - Virtual size: 7.3MB

🧠.$3G Size: 1024B - Virtual size: 737B

0fb696af733010bba6bae81be7ec2f21

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 172B

🧠<'0P
Size: - Virtual size: 508KB

🧠_qT(
Size: - Virtual size: 589KB

🧠GhQ5
Size: - Virtual size: 787KB

🧠=`9>
Size: - Virtual size: 21KB

🧠Bz:!
Size: - Virtual size: 8KB

🧠r>he
Size: - Virtual size: 5.3MB

🧠].E5
Size: 6KB - Virtual size: 5KB

🧠2ea&
Size: 7.3MB - Virtual size: 7.3MB

🧠.$3G
Size: 1024B - Virtual size: 737B

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 120B