coldperm cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
coldperm cracked.exe
Size 3.4MB
Sample260705-1e7dpafy4s
SHA256 bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0
MD5 a8f950d90dafd955bd35df41a610367b
SHA1 38095bc25010440a99b7cd1ec68a062cef64f01f
SHA512 723175a95486c7512d2801ae999e2f2d54808be47be6ff02789c3786a79be90f8af145ea81ff32c1e669f2e7e4d36d288aad1c575a374fa7e62e9a097d7ba5d8
SSDEEP 49152:DhyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYN:wY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T1CEF5DF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
coldperm cracked.exe

File Explorer

coldperm cracked.exe

.exe 3.4MB

coldperm cracked.exe

IMPHASH e9171193e02a133d066d2fccfabf01c6
SHA256 bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0
MD5 a8f950d90dafd955bd35df41a610367b
SHA1 38095bc25010440a99b7cd1ec68a062cef64f01f
SHA512 723175a95486c7512d2801ae999e2f2d54808be47be6ff02789c3786a79be90f8af145ea81ff32c1e669f2e7e4d36d288aad1c575a374fa7e62e9a097d7ba5d8
SSDEEP 49152:DhyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYN:wY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T1CEF5DF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1300256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\1337\Documents\clempermfull\x64\Release\coldperm.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

kernel32

QueryFullProcessImageNameW SetDllDirectoryW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetSystemInfo WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx AddDllDirectory CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW SetFileInformationByHandle CreateFile2 AreFileApisANSI UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect GetSystemDirectoryW GetTickCount64 GetCurrentThreadId CreateThread AddVectoredExceptionHandler CreateFileW GetProcessHeap DeleteCriticalSection LocalFree HeapDestroy HeapAlloc HeapReAlloc GetFileInformationByHandleEx GetLastError HeapSize InitializeCriticalSectionEx HeapFree QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc CreateProcessA GetCurrentProcessId Sleep TerminateProcess GetCurrentProcess GetModuleFileNameA GetModuleHandleW GetModuleFileNameW GetExitCodeProcess CreateProcessW CloseHandle MultiByteToWideChar GetFileAttributesExW WaitForSingleObject CreatePipe SetHandleInformation ReadFile MoveFileW MoveFileExW SetComputerNameExW GetTickCount GetFileAttributesA DeleteFileA GetVolumeInformationA OutputDebugStringW FindClose FindFirstFileW SetDefaultDllDirectories InitializeSListHead WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime IsDebuggerPresent

user32

DefWindowProcW UnregisterClassW PostQuitMessage UpdateWindow MessageBoxW CreateWindowExW GetKeyState GetMessageExtraInfo MessageBoxA LoadCursorW LoadIconW TranslateMessage SetLayeredWindowAttributes PeekMessageW DispatchMessageW ShowWindow GetSystemMetrics RegisterClassExW ReleaseCapture MoveWindow SendMessageW GetWindowRect SetClipboardData GetCursorPos SetCursor GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos IsWindowUnicode GetClientRect WindowFromPoint DestroyWindow SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient

advapi32

CryptCreateHash GetUserNameA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCloseKey GetTokenInformation GetLengthSid ConvertSidToStringSidW OpenProcessToken IsValidSid CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptGetHashParam CryptReleaseContext CryptAcquireContextW SetSecurityInfo RegDeleteKeyA RegCreateKeyExA InitializeAcl AddAccessAllowedAce CopySid

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

SafeArrayGetElement SafeArrayGetUBound VariantClear SysAllocString SysFreeString SafeArrayGetLBound VariantInit

msvcp140

?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Mtx_lock _Mtx_unlock ?_Xbad_function_call@std@@YAXXZ _Thrd_detach ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ _Xtime_get_ticks ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Query_perf_frequency ?_Xinvalid_argument@std@@YAXPEBD@Z

tbs

Tbsip_Submit_Command Tbsi_Context_Create Tbsip_Context_Close

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle HttpSendRequestA InternetConnectA HttpOpenRequestA InternetReadFile

urlmon

URLDownloadToFileA

iphlpapi

GetAdaptersInfo

crypt32

CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertGetCertificateChain CertOpenStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine

ws2_32

WSACleanup bind connect getpeername getsockname htons recv setsockopt WSAResetEvent WSAEventSelect __WSAFDIsSet select accept htonl listen recvfrom gethostname WSAWaitForMultipleEvents WSAIoctl WSAEnumNetworkEvents closesocket sendto WSAGetLastError WSACreateEvent ntohs WSACloseEvent WSASetLastError send socket getsockopt WSAStartup ioctlsocket inet_ntop inet_pton ntohl freeaddrinfo getaddrinfo

d3d9

Direct3DCreate9

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception wcschr strrchr memmove memcpy memcmp memchr _CxxThrowException memset __C_specific_handler strchr strstr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc free _recalloc _set_new_mode calloc realloc _callnewh

api-ms-win-crt-string-l1-1-0

wcsncpy strpbrk wcsncmp strspn wcspbrk strncmp strcspn _wcsdup wcslen strlen _strdup _stricmp isspace isxdigit towlower strnlen strcpy_s strncpy_s tolower strncpy toupper strcmp

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e exit _initterm _get_narrow_winmain_command_line _set_app_type __sys_errlist __sys_nerr _seh_filter_exe _cexit abort _crt_atexit _register_onexit_function _invoke_watson _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo _errno _beginthreadex system terminate

api-ms-win-crt-stdio-l1-1-0

fputc fflush fclose _wopen _pclose fgetc fputs fgets fwrite fseek setvbuf _popen fopen_s ungetc fsetpos __stdio_common_vsprintf_s fread _set_fmode _fseeki64 _get_stream_buffer_pointers ftell __stdio_common_vsscanf __p__commode __stdio_common_vsprintf _read _write _wfopen feof _fileno _close __stdio_common_vfprintf __acrt_iob_func ferror _lseeki64 fgetpos

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlink _unlock_file _lock_file _fstat64

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-math-l1-1-0

ldexp ceilf cosf sinf sqrtf roundf _dsign _dclass fmodf _fdopen acosf __setusermatherr powf

api-ms-win-crt-convert-l1-1-0

wcstombs strtoul strtol atoi strtod strtoull strtoll

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 strftime _localtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv