C:\Users\Savas\Desktop\AntiCrash\Anti-Crash\Anti-Crash\obj\x64\Release\Anti-Crash.pdb
Overview
overview
9Static
static
7Chaos V3/A...o).exe
windows7-x64
1Chaos V3/A...o).exe
windows10-2004-x64
1Chaos V3/C...V3.exe
windows7-x64
9Chaos V3/C...V3.exe
windows10-2004-x64
9Chaos V3/d...ix.exe
windows7-x64
7Chaos V3/d...ix.exe
windows10-2004-x64
7Chaos V3/f...er.exe
windows7-x64
1Chaos V3/f...er.exe
windows10-2004-x64
1Chaos V3/p...nd.exe
windows7-x64
3Chaos V3/p...nd.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Chaos V3/Anti-Crash (Anti-Crash method by 13ooeo).exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Chaos V3/Anti-Crash (Anti-Crash method by 13ooeo).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Chaos V3/Chaos Launcher V3.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Chaos V3/Chaos Launcher V3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Chaos V3/datamodelfix.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Chaos V3/datamodelfix.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Chaos V3/fpsunlocker.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Chaos V3/fpsunlocker.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Chaos V3/pssuspend.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Chaos V3/pssuspend.exe
Resource
win10v2004-20240802-en
General
-
Target
Chaos_V3.rar
-
Size
18.9MB
-
MD5
e993b89da61dadbd6a53e588a249c659
-
SHA1
70dbc0a8b65596ed22a41a7df44365f3f52605c1
-
SHA256
6dc7452115f902969b8a3fa2a25b9e1e52c9b2e6913b001b1839ca16e2c981fd
-
SHA512
163349eca45fc2d08d1afafadda74a9ff6b34049c7340ef75a562ab4c6010427182a977a560cb250a6101a772cd5d817adba960c2f053660aa3d2b28cda6a7ef
-
SSDEEP
393216:PzwOO23fGceaah+A/RmE1xlRxh5elwQNuyKzwELMDBiWBohnPsFtaj5Kmdet:P0OX36+YME1xlRcNvKUA0On0FtaQMet
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Chaos V3/Chaos Launcher V3.exe themida -
Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Chaos V3/datamodelfix.exe pyinstaller -
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Chaos V3/Anti-Crash (Anti-Crash method by 13ooeo).exe unpack001/Chaos V3/Chaos Launcher V3.exe unpack001/Chaos V3/datamodelfix.exe unpack001/Chaos V3/fpsunlocker.exe
Files
-
Chaos_V3.rar.rar
-
Chaos V3/Anti-Crash (Anti-Crash method by 13ooeo).exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Chaos V3/Chaos Launcher V3.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 70KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 23KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
Chaos V3/READ ME.txt
-
Chaos V3/datamodelfix.exe.exe windows:5 windows x64 arch:x64
bae3d3e8262d7ce7e9ee69cc1b630d3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
GetWindowThreadProcessId
ShowWindow
kernel32
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
SetDllDirectoryW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetConsoleWindow
HeapSize
GetLastError
WriteConsoleW
SetEndOfFile
GetStartupInfoW
TlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Sections
.text Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
datamodelfix.pyc
-
Chaos V3/fpsunlocker.exe.exe windows:6 windows x64 arch:x64
b67b812388a1094acd5db594749b4971
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
D:\a\rbxfpsunlocker\rbxfpsunlocker\x64\Release\rbxfpsunlocker.pdb
Imports
kernel32
GetProcessId
CreateMutexA
DuplicateHandle
OpenProcess
Sleep
GetLastError
CloseHandle
ReadProcessMemory
VirtualQueryEx
GetExitCodeProcess
Process32First
CreateToolhelp32Snapshot
QueryFullProcessImageNameA
Process32Next
Module32FirstW
Module32NextW
IsWow64Process
SetConsoleTitleA
TerminateThread
FreeConsole
CreateThread
GetConsoleWindow
AllocConsole
GetStdHandle
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
SetConsoleTextAttribute
GetCurrentProcess
GetConsoleScreenBufferInfo
SetEndOfFile
WriteProcessMemory
LCMapStringW
HeapFree
HeapAlloc
GetFileType
SetFilePointerEx
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetFileSizeEx
RtlUnwind
user32
EnumWindows
GetWindowTextA
MessageBoxA
IsWindowVisible
GetSystemMenu
GetMessageA
CheckMenuRadioItem
DispatchMessageA
LoadCursorA
CreatePopupMenu
TrackPopupMenu
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconA
AppendMenuA
CheckMenuItem
PostQuitMessage
EnableMenuItem
RegisterClassExA
SetForegroundWindow
GetCursorPos
GetWindowThreadProcessId
gdi32
GetStockObject
advapi32
RegOpenKeyExA
RegQueryValueExA
shell32
Shell_NotifyIconA
ShellExecuteA
SHGetKnownFolderPath
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
Sections
.text Size: 367KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Chaos V3/info/manifest.json
-
Chaos V3/pssuspend.exe.exe windows:6 windows x86 arch:x86
32f7a5e0ecd105d509a9d9677d178190
Code Sign
33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cdCertificate
IssuerCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before12-05-2022 20:46Not After11-05-2023 20:46SubjectCN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0e:90:d2:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before08-07-2011 20:59Not After08-07-2026 21:09SubjectCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
94:b1:87:4b:67:89:c9:82:50:bf:08:9b:47:dc:4c:8d:ad:32:3d:6a:8a:78:50:b1:e5:a8:53:e5:2b:07:6b:61Signer
Actual PE Digest94:b1:87:4b:67:89:c9:82:50:bf:08:9b:47:dc:4c:8d:ad:32:3d:6a:8a:78:50:b1:e5:a8:53:e5:2b:07:6b:61Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
D:\a\1\s\pssuspend\exe\Win32\Release\pssuspend.pdb
Imports
ws2_32
WSAStartup
gethostname
gethostbyname
inet_ntoa
mpr
WNetCancelConnection2A
WNetAddConnection2A
version
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueW
VerQueryValueA
kernel32
GetFileType
GetModuleHandleA
GetProcAddress
LocalAlloc
LocalFree
GetModuleFileNameA
GetModuleFileNameW
VerSetConditionMask
CreateFileA
DeleteFileA
WriteFile
CloseHandle
WaitForSingleObject
GetCommandLineW
GetCurrentProcess
GetTickCount
GetSystemDirectoryA
FreeLibrary
LoadResource
LockResource
SizeofResource
FormatMessageA
FindResourceA
VerifyVersionInfoA
WideCharToMultiByte
GetConsoleScreenBufferInfo
OpenProcess
ReadFile
GetFileSizeEx
LoadLibraryExA
GetStdHandle
GetVersionExA
SetLastError
GetComputerNameA
GetLastError
SetFilePointerEx
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
Sleep
VirtualProtect
RaiseException
GetSystemInfo
SetEndOfFile
VirtualQuery
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetConsoleCP
ExitProcess
GetModuleHandleExW
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CreateFileW
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
comdlg32
PrintDlgA
advapi32
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
Sections
.text Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ