CR_Sense.zip
- SHA256 28f032d2c083e1facd674f2b2c455b2c24c51996d43a549bbeb0f5bd9dc97da7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CR_Sense.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
color.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
pmm.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
sensefucker.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target CR_Sense.zip
- Size 15.7MB
- Sample260620-cjpsfacy2l
- SHA256 28f032d2c083e1facd674f2b2c455b2c24c51996d43a549bbeb0f5bd9dc97da7
- MD5 1c635a0d676187fbdb90a9394af9cf61
- SHA1 8b508dc48b7c17edf62a094176c823e44356f104
- SHA512 3cc119061e267d29922c4ed1590760f8c6c3fb4c6a018a4168efffc4f48529feff7e742fde404f762799d057c65cf5c7d9c743055c4a0c2049fd42e416c6c44d
- SSDEEP 393216:SoaZfhUlfKem6Zl36ofxnFfrB1kzOpcxBQMO:RathApm6Zlqo5nhXkzPxzO
- TLSH T1A7F6339AB6E158CD832CBD2F19EF480E932F3374B6564BA3C79E15986F1010ACBD6D11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/color.exe unpack001/pmm.dll unpack001/sensefucker.exe
File Explorer
-
CR_Sense.zip.zip 15.7MB
-
color.exe.exe 13.8MB
-
pmm.dll.dll 3.5MB
-
sensefucker.exe.exe 27KB
color.exe
- IMPHASH bd40b6f327862ecab1c754ccf8a9b092
- SHA256 d8809594785d9d33d0cb7399610f08dcc4bdfd379ad3a37991bc7f2c363fc4dc
- MD5 22bdfa48658b5839a920fa2c84cf64d6
- SHA1 81236a576717922e7f8ded0b71607fa622953319
- SHA512 6a55e90db9aa5c599430ded7e891e549b2f93f594f5a6c80b9fcf5ea1950be95222ea045e64d2cd542056d0325781af8786c44452a642736a5edeee6782b339c
- SSDEEP 196608:KeZsAulLV3fphUiuLIIHiLTKmn4bhFn50leFu1TnmHwXUZbD+DDvbq2YQ8F2lDrN:ytxRhUtLgemi3HWkeEQgcGM
- TLSH T16AE623EA50D431D4C4D78B34639F57CE61F1F5668C60A62937CB2C03EE31EAB9249A63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19232857
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReleaseSRWLockExclusive
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetDC
gdi32
CreateCompatibleDC
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
_Xtime_get_ticks
wininet
InternetOpenA
ws2_32
WSAAccept
crypt32
CertEnumCertificatesInStore
shlwapi
PathFindFileNameW
psapi
GetModuleInformation
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-stdio-l1-1-0
_close
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-string-l1-1-0
wcsncmp
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
Name
.text
Size
Virtual Size
978KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
285KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.dKe
Size
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.};%
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.R5&
Size
13.8MB
Virtual Size
13.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
pmm.dll
- IMPHASH 31a1ebd8234a830a524b3dd42fc68a7f
- SHA256 e0777157b923a0fa946724ffa9517b102d5ee32600ea4e67496912418b685214
- MD5 ddb393f29ad6e48dcb342b65400c51c0
- SHA1 18841ae6b83f88ba60fd04cca05a725c8d0c5c0e
- SHA512 1e61ccf6b5b3c6f2f22cbf036a7d2fa4231d7569b29a141272c6aeba2c04da4c2a1e30c07da8367f843e73d81bb9b4cf7117c1a44876a5c1abb8e5292b98240d
- SSDEEP 49152:TNgL4Gt7CCttzkSiBS9Cqx/HbQbv+hs9Sn19BqIP02fYOUj354FKN6LnHeLQIYO6:yLpzttzkPS9hev/4nw3/lJ4FBzIR6
- TLSH T1EDF523FA22D26C74C0A7F7B1896B737CB52F3B4689634C1E7BD81E434E126196879B01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5113680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
malloc
Name
.text
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.b-!
Size
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.PpL
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.8t{
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
sensefucker.exe
- IMPHASH fe7d020ab991dd45f59d28d308461125
- SHA256 265ab73f4a95a1b412cff8e66ece4a0eebd0c086482ec43d4c8e20c7e4864b4e
- MD5 0c94222f17e2abdc2b626a7ef61265eb
- SHA1 cd5bae48e62f26946f4c4a34c6ad80ea7d81e80b
- SHA512 3a702afc8221f2d45f1389f900f36bbb42668c2241930a8053a303d4dbff660bd0321bd815661cb731c4fc3ca555fb0aca9d3ca9a16ec683c3a6e7cdd65b7e6b
- SSDEEP 384:3459hY4Br3/L+h1Q5KYVG7nquNzsX88bx8/AS3N:343ys3/Ch4KYVG7ZGM86/V3N
- TLSH T1D9C20A1D989F06A4DEE67AB8443A2356F31AB52D0FF0586BF3DC40B869265DCB391D03
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\umutt\source\repos\CheesyAim_Crac\x64\Release\injector.pdb
kernel32
SetConsoleTitleA
GetCurrentProcess
VirtualAlloc
WaitForSingleObject
UnmapViewOfFile
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Sleep
GetLastError
GetFileAttributesA
VirtualFree
CreateFileA
GetSystemDirectoryA
Process32FirstW
CloseHandle
Module32FirstW
GetProcAddress
VirtualAllocEx
CreateFileMappingA
CreateRemoteThread
Module32NextW
VirtualFreeEx
MapViewOfFile
RtlCaptureContext
WriteProcessMemory
Process32NextW
GetModuleFileNameA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
advapi32
GetTokenInformation
OpenProcessToken
shell32
ShellExecuteA
ShellExecuteExA
vcruntime140
__current_exception_context
strrchr
memcpy
__C_specific_handler
__current_exception
memset
api-ms-win-crt-stdio-l1-1-0
__p__commode
__acrt_iob_func
__stdio_common_vfprintf
_set_fmode
api-ms-win-crt-string-l1-1-0
_wcsicmp
strcat_s
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_c_exit
_crt_atexit
terminate
_seh_filter_exe
_cexit
_configure_narrow_argv
__p___argc
__p___argv
_register_onexit_function
_initialize_narrow_environment
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=19, id=261, version=35207,
count=7, id=257, version=33140,
count=84, id=1, productName=Unmarked objects,
count=1, id=265, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,