umbral | DeltaCrack[.]exe | Triage

Sharing

General

Target

DeltaCrack.exe
Size

259KB
MD5

31ad590c8b916b8fd2940c88cb4ec5e1
SHA1

b4fefbb7baf5e5f62fa7cddd7ac1cf2e02e57aca
SHA256

9aef7a2f101a0ee9126a42195cd4d646aa8af678efea884617c67f1d4ba38ac0
SHA512

ec23dc58cf781962cfc07c373a4c4b02bd3a620f1557c8c2901dc26917876f30aba73b765c4ced6bf24f8714a21221804928d7b85d5dbb22652baf1072a19ffc
SSDEEP

6144:RlloZMHrIkd8g+EtXHkv/iD4cOICli8e1mhOj+iW:poZIL+EP8b6BjzW

Score

10^/10

umbral

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
sample	family_umbral

Umbral family
umbral

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DeltaCrack.exe

Files

DeltaCrack.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ