Static task
static1
Behavioral task
behavioral1
Sample
Crystaline Executer (2)-protected.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Crystaline Executer (2)-protected.exe
Resource
win10v2004-20240802-en
General
-
Target
Crystaline Executer (2)-protected.exe
-
Size
126KB
-
MD5
69bbca05ba8da31617bdf28de290540c
-
SHA1
568ca6cbfd1f8c4d3af471b84de28fd94a5b6010
-
SHA256
2dd21f959480add9d40b4ff5dea583cfdb07795b7f315117c45f07b704b50824
-
SHA512
b6d8a0c90b4e2befd6042b1ff848aab10742e01193a66c245dcb939abc0ba9088698f8f83d639a3586b7c7854f106eba62064dff8e1f5aad0527fc31a2e616aa
-
SSDEEP
1536:igkaIfMcwO6uGsMf7iJH/gMBSc1w7dyk+iGh2W2lklWVTNF1ZJjH/yyyVi1Fm:3CNFGrmR/vgbZbFm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Crystaline Executer (2)-protected.exe
Files
-
Crystaline Executer (2)-protected.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
TiH jx7 Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TiH jx7 Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ