crunchy-cli-v3[.]6[.]7-windows-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
crunchy-cli-v3.6.7-windows-x86_64.exe
Size 7.9MB
Sample260701-ddcflaey9t
SHA256 dae88da2bad173e5895fc9fab8a59bde9f6fc448704717ab91fbba026249475c
MD5 5b88a7ee092a00b64130329f167e036e
SHA1 6301730a3484533e98bbc7bab9cd0cc83f77ca71
SHA512 b4e1ef9370b6daf649242f8142ef9b031dea489650c42f152ebfef8625986d4ad34feae12c75d3974c0c715fdb7cbcb35cd3546eafb3cba9e9c93912632a96d7
SSDEEP 98304:78vM++vghnMIgROWTVjM03q/JIABS913+sm2x:7r++v2n5QjMnaqiE2
TLSH
T13A863A03F6A185E9C4A9C4B88357A633F771BC89463873AB5BE04F212F15B50AF0E759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crunchy-cli-v3.6.7-windows-x86_64.exe

File Explorer

crunchy-cli-v3.6.7-windows-x86_64.exe

.exe 7.9MB

crunchy-cli-v3.6.7-windows-x86_64.exe

IMPHASH 9f980cb9783c97dbb8a4f920d81de809
SHA256 dae88da2bad173e5895fc9fab8a59bde9f6fc448704717ab91fbba026249475c
MD5 5b88a7ee092a00b64130329f167e036e
SHA1 6301730a3484533e98bbc7bab9cd0cc83f77ca71
SHA512 b4e1ef9370b6daf649242f8142ef9b031dea489650c42f152ebfef8625986d4ad34feae12c75d3974c0c715fdb7cbcb35cd3546eafb3cba9e9c93912632a96d7
SSDEEP 98304:78vM++vghnMIgROWTVjM03q/JIABS913+sm2x:7r++v2n5QjMnaqiE2
TLSH
T13A863A03F6A185E9C4A9C4B88357A633F771BC89463873AB5BE04F212F15B50AF0E759
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoTaskMemFree

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

shell32

SHGetKnownFolderPath

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EnterCriticalSection ExitProcess FillConsoleOutputAttribute FillConsoleOutputCharacterA FindClose FindFirstFileW FindNextFileW FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleCursorInfo GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNumberOfConsoleInputEvents GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetUserPreferredUILanguages GetVolumePathNameW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleInputW ReadFile ReadFileEx ReleaseSemaphore RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetFileCompletionNotificationModes SetFileInformationByHandle SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UpdateProcThreadAttribute VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFileEx __C_specific_handler lstrlenW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite ldexp malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

Name

.text

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

478KB

Virtual Size

477KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

crunchy-cli-v3.6.7-windows-x86_64.exe

advapi32

crypt32

ntdll

ole32

secur32

shell32

ws2_32

bcrypt

kernel32

msvcrt

api-ms-win-core-synch-l1-2-0

bcryptprimitives

generic