source crack hotfix.rar
- SHA256 a18e76458ee33d17284ccbbe7db387df9e44b9a30a7846abcb6501723439b3e6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
source crack hotfix.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
source crack hotfix/hook_dll.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
source crack hotfix/launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
source crack hotfix/tnameserv.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target source crack hotfix.rar
- Size 22.9MB
- Sample260622-raqeyacw7n
- SHA256 a18e76458ee33d17284ccbbe7db387df9e44b9a30a7846abcb6501723439b3e6
- MD5 2a8e1cc505840818e0206e45f2a48579
- SHA1 309c553642523a9d7441d968b8bf18fadf0c8734
- SHA512 a5858cdf91f1d1c895f68cad99e1f4b2da0e71e44a5d95bdc2b66fd1448364353a28a99c6582d3fdd7fa244ecd64b76422e5dfada338d9642f4acab07a234d96
- SSDEEP 393216:plU2TZXQdKu6KujDxYsmzhHCDaAn/n08DR1bW217RFC9dnAz15YYB9or:plU29XQYu1u3xihi1MozS21G25YoC
- TLSH T18B3733DF78F2856072ABBDFA8984C45C613CA5B11B94D3FD8670FF54CE1AE3A0909990
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/source crack hotfix/hook_dll.dll unpack001/source crack hotfix/launcher.exe unpack001/source crack hotfix/tnameserv.exe
File Explorer
-
source crack hotfix.rar.rar 22.9MB
-
source crack hotfix/hook_dll.dll.dll 161KB
-
source crack hotfix/instr.txt170B
-
source crack hotfix/launcher.exe.exe 106KB
-
source crack hotfix/tnameserv.exe.exe 27.1MB
source crack hotfix/hook_dll.dll
- IMPHASH 5705ed73891588df1175b0400ab092ff
- SHA256 48b5f26f3a51f8c21d04515d137333f027639b2f94bc6917486225288579ca85
- MD5 4936188193a41f957706b43f96e7040a
- SHA1 7a918e6851f706a072e41ce4a1a83a40e765e7ba
- SHA512 ac15b20fea737f35739026596caf88c6aaebbb925c2f016291bae959cd932ae5a08dd8742c00abfc7925faa64e5f5593f6ee797d9ee2e807f1c8e1c08d8c08c2
- SSDEEP 3072:XykPxYktdxOCcVardhOid6IB5daYX2hlyv/jX8b:XykPxYktocrLL9Bf7k
- TLSH T1A8F35C1BF66A407FE2278938C9830A01EB727C514B90EADF53504ABA1F277D49E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
29376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
Sleep
GetCurrentProcess
CreateThread
DisableThreadLibraryCalls
GetModuleHandleW
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
CloseHandle
GetLastError
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
LoadLibraryExW
LCMapStringW
GetStdHandle
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
HeapSize
CreateFileW
WriteConsoleW
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=139, id=261, version=33145,
count=12, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=14, id=260, version=35721,
count=42, id=261, version=35721,
count=3, id=257, version=33145,
count=114, id=1, productName=Unmarked objects,
count=1, id=261, version=36248,
count=4, id=260, version=36248,
count=1, id=258, version=36248,
source crack hotfix/instr.txt
- SHA256 46eccbd87bcbbeaf1801549f901e811a63ec8392ff711d09522a56c45590f855
- MD5 964fa113108a2256cf4142f977b136f5
- SHA1 ea182fc53faaf7d90e733c5d40f55b8521090813
- SHA512 81b05350c399c9abb989f7be0b4010d8976262739e47a4aff740567d354455a0d08a1d8ded0c0d4b5b1182ba98853fb99a112b861a2b4e75e6e7ecc0edf70042
- TLSH T116C08C020E8A547E9AB352078F06E21EFCF910F67A2DD7110AE8211DB81B218CE78284
- MD5 SHA1 SHA512 TLSH
source crack hotfix/launcher.exe
- IMPHASH 11f69b14b89750e0a6078690304e9280
- SHA256 393e6a80fe9507d07cb333dd80c23643d0f7d15aeb570f9214a0015e578a2113
- MD5 0d2c2c7e78c0733c0feaf837d47beb01
- SHA1 aa3810b138e5ced694039dc5a7c88dda17ca7db9
- SHA512 eed7a255e3dc32f10486ba12e678e9364540afb4f9ce77ea194c54b7adfc7ae8d342411848c74e2723e5826d9ad5d6387c1adfc54f4ffad19d82b506f4d628f2
- SSDEEP 3072:rKkKwfrGePK3ThcUiGgTS3QpHfti9zq5H:VKwjKjh0TSgpFiaH
- TLSH T15BB34A6BB2FA30F9E173833885954645D772B83557219FEF03A0429A1F276E08D39F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileAttributesW
CloseHandle
GetLastError
WaitForSingleObject
TerminateProcess
CreateRemoteThread
ResumeThread
CreateProcessW
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
WriteConsoleW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
GetStdHandle
WriteFile
GetCurrentProcess
ExitProcess
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
HeapAlloc
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
VirtualProtect
LoadLibraryExW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
user32
wsprintfW
MessageBoxW
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=42, id=261, version=35721,
count=5, id=257, version=33145,
count=97, id=1, productName=Unmarked objects,
count=1, id=261, version=36248,
count=1, id=258, version=36248,
source crack hotfix/tnameserv.exe
- IMPHASH c7eed1e7421c9eceba4094c2e5669dbb
- SHA256 effea11698e5dfdc0cde796e6fbc9df31c61c2442aea3553131466065cfa7270
- MD5 ee8a4449ff5d6524e16f983f2785de91
- SHA1 a4ba6f2b7f1db2cce3c713ee0845419a1bcb14ce
- SHA512 1c952349cc26fcd1a4d3bf3429d615a644cced6437d4596e952874050e21befb765ab4ef4e095c195d2658467258092058026a6db7164df8661abfd057ea8115
- SSDEEP 393216:Cye2XsJ31A9pFuZsdbtqdKVGNlt/EYjHhIKM2HuqjApYrg1sapVxr:5e2O30SaqdKVGpTBa22fXr
- TLSH T16657239AA5D6A3D8CBC31994274D51DA22C2B8BA85ED94343EC71C03A474DEF058DEF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
26964389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
WideCharToMultiByte
user32
GetKeyState
advapi32
FreeSid
shell32
ShellExecuteW
ole32
CoCreateInstance
msvcp140
_Cnd_init_in_situ
ntdll
RtlAdjustPrivilege
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpOpen
crypt32
CertFreeCertificateContext
bcrypt
BCryptGetProperty
iphlpapi
GetAdaptersInfo
wevtapi
EvtQuery
imm32
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
isdigit
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_wremove
d3dcompiler_47
D3DCompile
Name
.text
Size
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
6.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.jQj
Size
Virtual Size
16.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.O]*
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.H]*
Size
27.1MB
Virtual Size
27.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ