CrystalityFree[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CrystalityFree.exe
Size 6.9MB
Sample260622-vdbbzaev5l
SHA256 324a9465e408e37e52cd6bd6c1ef09044bc8b41ccfbf9554b018c663c4c98c59
MD5 629c0cac04390c3b7fc69c755060b1f3
SHA1 3b584e6e61578d39d9dc24ab47c132c4662debb1
SHA512 2a9114ee8d46fea7b87cc031f73a08145499f396fccdb0514aa44e9e485d88a9ff49451a865af75b36a16951f1db4b93d963656d94284b4fe542596e096b4485
SSDEEP 98304:Q32T6iitbDKdeUxCgkKwSTGaGw/BwCnKeb5x3/0rDZOkn+:Q32QhKx8GZwbeFV0XZOq
TLSH
T105769E03F6A241ECC0AEC178935A9733E732B88D493476AB1BE41B212F66F506F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CrystalityFree.exe

File Explorer

CrystalityFree.exe

.exe 6.9MB

CrystalityFree.exe

IMPHASH 5b98a1aa64f929de91634726acc459e1
SHA256 324a9465e408e37e52cd6bd6c1ef09044bc8b41ccfbf9554b018c663c4c98c59
MD5 629c0cac04390c3b7fc69c755060b1f3
SHA1 3b584e6e61578d39d9dc24ab47c132c4662debb1
SHA512 2a9114ee8d46fea7b87cc031f73a08145499f396fccdb0514aa44e9e485d88a9ff49451a865af75b36a16951f1db4b93d963656d94284b4fe542596e096b4485
SSDEEP 98304:Q32T6iitbDKdeUxCgkKwSTGaGw/BwCnKeb5x3/0rDZOkn+:Q32QhKx8GZwbeFV0XZOq
TLSH
T105769E03F6A241ECC0AEC178935A9733E732B88D493476AB1BE41B212F66F506F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4126064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crystality_free.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile RtlNtStatusToDosError NtCreateFile RtlGetVersion NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile

kernel32

LoadLibraryA GetCurrentThreadId FlsFree EncodePointer SleepConditionVariableSRW GetModuleHandleW LCIDToLocaleName GetUserDefaultUILanguage GetProcessId SetLastError InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx GetSystemTimeAsFileTime CompareStringOrdinal GetCurrentProcessId LoadLibraryW SwitchToThread GetSystemTimePreciseAsFileTime HeapReAlloc RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess WideCharToMultiByte ReleaseSRWLockExclusive WaitForSingleObject MultiByteToWideChar HeapAlloc HeapFree FormatMessageW GetModuleFileNameW SetHandleInformation SleepEx SetWaitableTimer ExitProcess GetSystemDirectoryW GetWindowsDirectoryW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext SetThreadStackGuarantee AcquireSRWLockExclusive GetCommandLineW SetEnvironmentVariableW AddVectoredExceptionHandler GetModuleHandleA Sleep GetProcAddress GetFileAttributesW CreateProcessW CancelIo CreateEventW CreateWaitableTimerExW ReadFileEx WriteFileEx CreateThread DeleteFileW GetTempPathW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime CloseHandle CreateDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA SetNamedPipeHandleState RtlPcToFileHeader CreateFileW CreatePipe CancelIoEx SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx ReadFile PostQueuedCompletionStatus WriteFile GetOverlappedResult GetFinalPathNameByHandleW CopyFileExW GetFullPathNameW FindFirstFileExW FindClose GetSystemInfo TerminateProcess FindNextFileW GetLastError lstrlenW FlsSetValue RaiseException FlsGetValue FlsAlloc GetCurrentThread FreeLibrary InitializeCriticalSectionEx ReleaseMutex LoadLibraryExA WakeAllConditionVariable LoadLibraryExW OutputDebugStringW OutputDebugStringA DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

FlashWindowEx AdjustWindowRect RedrawWindow PostMessageW EnumDisplayMonitors GetWindowLongPtrW LoadCursorW SetCursor RegisterTouchWindow RegisterClassExW CreateWindowExW IsWindow IsWindowEnabled IsIconic IsWindowVisible SetCursorPos EnableWindow SetPropW GetKeyboardState SetWindowTextW GetWindowTextW GetWindowTextLengthW InvalidateRect SetWindowDisplayAffinity SetWindowPos GetMessageA MonitorFromRect ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout ClipCursor GetSystemMetrics GetClipCursor ShowCursor SystemParametersInfoW UpdateWindow TranslateMessage DispatchMessageA EnumChildWindows GetAsyncKeyState GetKeyState MonitorFromPoint ScreenToClient GetMonitorInfoW SetCapture GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SetWindowLongW GetSystemMenu DefWindowProcW RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture GetTouchInputInfo CloseTouchInputHandle TrackMouseEvent RegisterWindowMessageA FindWindowExW IsProcessDPIAware MonitorFromWindow GetWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu SetFocus GetParent SetWindowRgn TranslateAcceleratorW GetMenuItemInfoW GetForegroundWindow MsgWaitForMultipleObjectsEx DispatchMessageW MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData GetMessageW SetWindowLongPtrW DestroyWindow SetParent

comctl32

DefSubclassProc TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass

oleaut32

SetErrorInfo SysStringLen SysFreeString GetErrorInfo

ole32

CoInitializeEx OleInitialize CoTaskMemAlloc CoTaskMemFree CoCreateFreeThreadedMarshaler RevokeDragDrop RegisterDragDrop CoUninitialize CoCreateInstance CoInitialize

shlwapi

SHCreateMemStream

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shell32

DragFinish ShellExecuteExW SHAppBarMessage SHGetKnownFolderPath ShellExecuteW DragQueryFileW SHOpenFolderAndSelectItems ord190 ord155

gdi32

GetDeviceCaps DeleteObject CreateSolidBrush BitBlt CreateRectRgn SelectObject CreateDIBSection DeleteDC SetBkMode SetTextColor CombineRgn CreateCompatibleDC

advapi32

EventUnregister RegCloseKey RegQueryValueExW RegOpenKeyExW RegGetValueW EventSetInformation SystemFunction036 EventRegister EventWriteTransfer

ws2_32

shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind WSASend connect ioctlsocket WSASocketW recv closesocket WSAIoctl getsockname WSAGetLastError getpeername getsockopt

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

strcpy_s wcscmp wcslen _wcsicmp

api-ms-win-crt-math-l1-1-0

trunc floor roundf pow round __setusermatherr

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit terminate _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _set_app_type _configure_narrow_argv _initterm _cexit __p___argv _initialize_narrow_environment _get_initial_narrow_environment __p___argc abort _initterm_e exit _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc _callnewh free