itscrakedddd[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
itscrakedddd.exe
Size 5.1MB
Sample260702-btn38ahs9m
SHA256 b976593a86661cff073defedf23f2500f67fce1d4ba79256d3611bec187d9072
MD5 0a02891f2ecdcc6ba574a734d99242e9
SHA1 dd9a9d2d4b07c2c24b54be7257e2c62e40e8ebeb
SHA512 670aa638b6a7fc069eb78ca36a62be70e7df51cbf6059b8abac0a23e0dd9f0df88ea7f07cf564811219caf14601fefeeb9d6f9675fc166e0fdc94adf79fcb23e
SSDEEP 24576:/EbjLhySrlAnClOi2PKorks/khsDaxAZG0Bv4kObnwppM4KFr:/+VyWldp2PKo1/exuBvUnw
TLSH
T16C36D5497681D488FA654F30F1A692F4A4B63D58F6C9808F47F27CD6BAB25FD2C27081
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
itscrakedddd.exe

File Explorer

itscrakedddd.exe

.exe 5.1MB

itscrakedddd.exe

IMPHASH 735e37dcbd27f7927e292b7bc9e1e64f
SHA256 b976593a86661cff073defedf23f2500f67fce1d4ba79256d3611bec187d9072
MD5 0a02891f2ecdcc6ba574a734d99242e9
SHA1 dd9a9d2d4b07c2c24b54be7257e2c62e40e8ebeb
SHA512 670aa638b6a7fc069eb78ca36a62be70e7df51cbf6059b8abac0a23e0dd9f0df88ea7f07cf564811219caf14601fefeeb9d6f9675fc166e0fdc94adf79fcb23e
SSDEEP 24576:/EbjLhySrlAnClOi2PKorks/khsDaxAZG0Bv4kObnwppM4KFr:/+VyWldp2PKo1/exuBvUnw
TLSH
T16C36D5497681D488FA654F30F1A692F4A4B63D58F6C9808F47F27CD6BAB25FD2C27081
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

471092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Daniel\Desktop\Temp Spoofer Freeze\ZukisLoader\examples\example_win32_directx11\Release\Loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpReadData WinHttpReceiveResponse WinHttpSetOption WinHttpQueryDataAvailable

ntdll

RtlCaptureContext RtlLookupFunctionEntry VerSetConditionMask RtlVirtualUnwind

advapi32

RegCloseKey GetUserNameA RegOpenKeyExA RegQueryValueExA

kernel32

CreateFileW FindClose OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA VirtualProtect GetCurrentProcess TerminateProcess GetEnvironmentVariableA OpenProcess Sleep K32GetModuleFileNameExA QueryFullProcessImageNameA GetSystemDirectoryA GetVersionExA CloseHandle GetWindowsDirectoryA K32EnumProcesses FindFirstFileW GetModuleHandleW K32EnumProcessModules IsDebuggerPresent GetComputerNameA WriteFile GetVolumeInformationA WaitForSingleObject GetTempPathA CreateFileA DeleteFileA CreateProcessA GetExitCodeProcess FindFirstFileExW GetLocaleInfoEx FormatMessageA LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive AreFileApisANSI GetLastError GetFileInformationByHandleEx FindNextFileW GetFileAttributesExW ExitProcess

user32

CloseClipboard EmptyClipboard GetClipboardData OpenClipboard MonitorFromPoint DestroyWindow SetClipboardData GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW TranslateMessage UpdateLayeredWindow PostQuitMessage CreateWindowExW GetCursorPos ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetDC GetMessageExtraInfo GetKeyState DefWindowProcW UpdateWindow

gdi32

SelectObject DeleteDC DeleteObject GetDeviceCaps CreateCompatibleDC CreateDIBSection

shell32

ShellExecuteExA ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

msvcp140

?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Query_perf_frequency ?_Xinvalid_argument@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z _Query_perf_counter ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?tolower@?$ctype@D@std@@QEBADD@Z _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp _CxxThrowException memset __C_specific_handler __current_exception_context memchr strrchr __std_exception_copy __std_exception_destroy strchr strstr __std_terminate __current_exception memmove

api-ms-win-crt-stdio-l1-1-0

ftell __stdio_common_vfprintf __p__commode _set_fmode fputs fopen_s fclose __acrt_iob_func fwrite fflush _get_stream_buffer_pointers _fseeki64 fsetpos ungetc _wfopen setvbuf fgetpos fgetc __stdio_common_vsprintf_s __stdio_common_vsprintf fputc fread __stdio_common_vsscanf fseek

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

_stricmp strncpy_s strncpy isalnum tolower strncmp strcmp

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _set_app_type _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit abort _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _errno _wassert terminate _get_narrow_winmain_command_line _beginthreadex _crt_atexit _invoke_watson

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_gmtime64_s strftime

api-ms-win-crt-math-l1-1-0

fmodf cosf ceilf sqrtf sinf acosf __setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale