OVktLFngQdIMzyjQ
Static task
static1
Behavioral task
behavioral1
Sample
cr.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cr.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
cr.exe
Resource
win7-20240903-en
General
-
Target
burgi.zip
-
Size
481KB
-
MD5
dd0b8601c130105152aa794d1a6cc764
-
SHA1
b20aef67b9bd29cc51c52d5f4164d06df117f02b
-
SHA256
ce5052677dc253b8e9e9ee3b3e2ab7fcc3b60c9238f2b19024377d334d9e2ef1
-
SHA512
def1c91b9e61e79295adf8fc659caed3e6e2b2cea883fdc1c737e0e1fcd075b2e6d22d589436ee44eb5171450c8cc80dc4769362e4688fec8f3eae7cac3c1fd4
-
SSDEEP
12288:bXksIWrbCXIXePZ1f1UxjXI3Ez8vF15Y49OlUkXGjt:bUs2rCxjXI0QT5nkC
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/cr.dll unpack001/cr.exe
Files
-
burgi.zip.zip
-
cr.dll.dll windows:4 windows x86 arch:x86
b97fa3bdf4b5ba2bade1315e09693924
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFlags
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
GetDllDirectoryA
GetNLSVersion
GetSystemTimeAsFileTime
MulDiv
SignalObjectAndWait
TlsGetValue
VirtualFreeEx
WriteFileEx
_lclose
msvcrt
_amsg_exit
_initterm
_iob
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
avrt
AvQuerySystemResponsiveness
AvRevertMmThreadCharacteristics
AvRtCreateThreadOrderingGroup
AvRtCreateThreadOrderingGroupExA
AvRtWaitOnThreadOrderingGroup
AvSetMmMaxThreadCharacteristicsW
dnsapi
DnsAcquireContextHandle_A
DnsModifyRecordsInSet_A
DnsModifyRecordsInSet_W
DnsNameCompare_W
DnsQuery_UTF8
DnsRecordSetCompare
DnsRecordSetDetach
DnsReplaceRecordSetW
DnsWriteQuestionToBuffer_UTF8
imm32
ImmAssociateContext
ImmGetCompositionFontA
ImmGetConversionListW
ImmGetImeMenuItemsA
ImmGetOpenStatus
ImmGetRegisterWordStyleA
ImmGetStatusWindowPos
ImmIsUIMessageA
ImmSetCandidateWindow
magnification
MagGetColorEffect
MagGetImageScalingCallback
MagGetWindowFilterList
MagGetWindowTransform
MagInitialize
MagSetColorEffect
MagSetWindowSource
MagUninitialize
prntvpt
PTCloseProvider
PTConvertDevModeToPrintTicket
PTGetPrintCapabilities
PTMergeAndValidatePrintTicket
PTOpenProvider
PTOpenProviderEx
PTQuerySchemaVersionSupport
PTReleaseMemory
resutils
ResUtilAddUnknownProperties
ResUtilEnumProperties
ResUtilFindExpandedSzProperty
ResUtilGetPropertyFormats
ResUtilIsResourceClassEqual
ResUtilSetResourceServiceStartParameters
samcli
NetGroupEnum
NetLocalGroupDelMembers
NetLocalGroupEnum
NetLocalGroupSetInfo
NetLocalGroupSetMembers
NetUserAdd
NetUserDel
NetUserModalsSet
slc
SLClose
SLFireEvent
SLGenerateOfflineInstallationId
SLGetGenuineInformation
SLGetLicense
SLGetLicenseFileId
SLGetPolicyInformation
SLGetSLIDList
SLGetWindowsInformationDWORD
version
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerFindFileA
VerFindFileW
VerLanguageNameA
VerQueryValueW
wldap32
LdapUTF8ToUnicode
ldap_create_sort_controlA
ldap_modify_ext_s
ldap_modrdn_sA
ldap_search_abandon_page
ldap_search_ext_s
ldap_search_init_pageA
Exports
Exports
Sections
.text Size: 379KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 905KB - Virtual size: 904KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 172B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 82B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 552B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
cr.exe.exe windows:4 windows x86 arch:x86
9a18c9a1218befc609f3e5883cb86734
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GlobalAlloc
GlobalFlags
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
GetDllDirectoryA
GetNLSVersion
GetSystemTimeAsFileTime
MulDiv
SignalObjectAndWait
TlsGetValue
VirtualFreeEx
WriteFileEx
_lclose
msvcrt
__getmainargs
__initenv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
avrt
AvQuerySystemResponsiveness
AvRevertMmThreadCharacteristics
AvRtCreateThreadOrderingGroup
AvRtCreateThreadOrderingGroupExA
AvRtWaitOnThreadOrderingGroup
AvSetMmMaxThreadCharacteristicsW
dnsapi
DnsAcquireContextHandle_A
DnsModifyRecordsInSet_A
DnsModifyRecordsInSet_W
DnsNameCompare_W
DnsQuery_UTF8
DnsRecordSetCompare
DnsRecordSetDetach
DnsReplaceRecordSetW
DnsWriteQuestionToBuffer_UTF8
imm32
ImmAssociateContext
ImmGetCompositionFontA
ImmGetConversionListW
ImmGetImeMenuItemsA
ImmGetOpenStatus
ImmGetRegisterWordStyleA
ImmGetStatusWindowPos
ImmIsUIMessageA
ImmSetCandidateWindow
magnification
MagGetColorEffect
MagGetImageScalingCallback
MagGetWindowFilterList
MagGetWindowTransform
MagInitialize
MagSetColorEffect
MagSetWindowSource
MagUninitialize
prntvpt
PTCloseProvider
PTConvertDevModeToPrintTicket
PTGetPrintCapabilities
PTMergeAndValidatePrintTicket
PTOpenProvider
PTOpenProviderEx
PTQuerySchemaVersionSupport
PTReleaseMemory
resutils
ResUtilAddUnknownProperties
ResUtilEnumProperties
ResUtilFindExpandedSzProperty
ResUtilGetPropertyFormats
ResUtilIsResourceClassEqual
ResUtilSetResourceServiceStartParameters
samcli
NetGroupEnum
NetLocalGroupDelMembers
NetLocalGroupEnum
NetLocalGroupSetInfo
NetLocalGroupSetMembers
NetUserAdd
NetUserDel
NetUserModalsSet
slc
SLClose
SLFireEvent
SLGenerateOfflineInstallationId
SLGetGenuineInformation
SLGetLicense
SLGetLicenseFileId
SLGetPolicyInformation
SLGetSLIDList
SLGetWindowsInformationDWORD
version
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerFindFileA
VerFindFileW
VerLanguageNameA
VerQueryValueW
wldap32
LdapUTF8ToUnicode
ldap_create_sort_controlA
ldap_modify_ext_s
ldap_modrdn_sA
ldap_search_abandon_page
ldap_search_ext_s
ldap_search_init_pageA
cr
OVktLFngQdIMzyjQ
Sections
.text Size: 376KB - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 188B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ