CrytalTempCracked[.]exe

Resubmissions

05/07/2026, 17:51

260705-we8vasew4v8

05/07/2026, 17:49

260705-wee7zsew3y8

Sharing

Copy URL Twitter E-mail

General

Target
CrytalTempCracked.exe
Size 1.0MB
Sample260705-we8vasew4v
SHA256 b1011a92f0c763f1a55975f853e1ec68f2d74514df6b1858c3ea7c994d8bdb82
MD5 3bfcf3f9ad3c0ab57e1f7b5875f6c3eb
SHA1 505f34642d30e28a0d4ab25cf2ddccbd5d8efb90
SHA512 776e431497341199c625646f26e72e7f13709d8f7e6f5f9cf5470e84e6e903d68e4920bc904066436b3ca41d82a2e46fcd182866a396672893f0c6241fa8a084
SSDEEP 24576:p0sBpxxpwjJYZ6S/6alOjYDE/dMgAG//U6X8OgIb40N6TVxbz:p0sBvxpwCPpOhLAG//U6X8OgIbdN6bb
TLSH
T132358D5A67B801E9D1BBD17CC6678607E7B270491330ABDF02E086A51F13BE16B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CrytalTempCracked.exe

File Explorer

CrytalTempCracked.exe

.exe 1.0MB

CrytalTempCracked.exe

IMPHASH b5fdd04ab158a14ae45136bc27035ea3
SHA256 b1011a92f0c763f1a55975f853e1ec68f2d74514df6b1858c3ea7c994d8bdb82
MD5 3bfcf3f9ad3c0ab57e1f7b5875f6c3eb
SHA1 505f34642d30e28a0d4ab25cf2ddccbd5d8efb90
SHA512 776e431497341199c625646f26e72e7f13709d8f7e6f5f9cf5470e84e6e903d68e4920bc904066436b3ca41d82a2e46fcd182866a396672893f0c6241fa8a084
SSDEEP 24576:p0sBpxxpwjJYZ6S/6alOjYDE/dMgAG//U6X8OgIb40N6TVxbz:p0sBvxpwCPpOhLAG//U6X8OgIbdN6bb
TLSH
T132358D5A67B801E9D1BBD17CC6678607E7B270491330ABDF02E086A51F13BE16B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

756572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\DroxzZ\Documents\Crystal\Spoofer\Temp\Loader\Temp Spoofer\x64\Release\Temp Spoofer.pdb

kernel32

CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW FreeLibrary LoadLibraryW SleepEx GetSystemInfo GetTickCount MultiByteToWideChar WideCharToMultiByte MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx DeleteCriticalSection AreFileApisANSI CreateFile2 SetFileInformationByHandle InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError CheckRemoteDebuggerPresent IsDebuggerPresent QueryPerformanceCounter GetModuleHandleW ExitProcess GetThreadContext AddVectoredExceptionHandler CreateThread Process32FirstW QueryPerformanceFrequency GetCurrentThread Process32NextW CreateToolhelp32Snapshot OpenProcess GetFileAttributesW K32GetModuleFileNameExW GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetFileInformationByHandleEx SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetModuleHandleExW GetCurrentProcess VirtualProtect RemoveVectoredExceptionHandler GetTempPathW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl VirtualFree CreateProcessA GetConsoleWindow GetProcAddress CloseHandle GetConsoleMode Sleep GetModuleHandleA WaitForSingleObject SetCurrentConsoleFontEx SetConsoleMode GetStdHandle SetConsoleScreenBufferSize SetConsoleTitleA SetConsoleTextAttribute InitializeSListHead OutputDebugStringW GetConsoleScreenBufferInfo

user32

GetWindowLongW ShowScrollBar MessageBoxA SetWindowLongW

advapi32

CryptImportKey RegOpenKeyW RegCreateKeyW RegDeleteTreeW RegCloseKey RegSetKeyValueW RegQueryValueExW RegOpenKeyExW OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 CryptDestroyKey CryptEncrypt RegDeleteTreeA

shell32

ShellExecuteA

msvcp140

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_function_call@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JG@Z ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

iphlpapi

GetAdaptersInfo

psapi

GetModuleInformation

ntdll

RtlInitUnicodeString NtLoadDriver NtUnloadDriver NtQuerySystemInformation RtlAdjustPrivilege

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW

ws2_32

WSACleanup getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet connect bind select gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl WSAStartup getpeername getsockopt send inet_ntop WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSASetLastError closesocket WSAGetLastError inet_pton ntohs accept

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcschr strrchr strchr memset memcpy __current_exception_context __current_exception memcmp memchr _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate wcsstr __C_specific_handler strstr wcsrchr memmove

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _resetstkoflw system _invalid_parameter_noinfo _wsystem terminate _errno _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _invalid_parameter_noinfo_noreturn _initterm exit _get_initial_narrow_environment abort _set_app_type _seh_filter_exe __sys_nerr __sys_errlist _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free realloc malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

_lseeki64 __acrt_iob_func fgets _setmode _wfopen _wopen _set_fmode _fileno __stdio_common_vsscanf _pclose fputc ftell fseek __p__commode fflush _read _write feof ungetc _close fgetpos fputs _popen setvbuf fclose _get_stream_buffer_pointers fgetc fwrite fsetpos __stdio_common_vsprintf fread _fseeki64

api-ms-win-crt-string-l1-1-0

strncmp strcspn _wcsdup wcslen strlen wcscmp _strdup wcspbrk strspn strcmp _stricmp wcsncmp wcscpy_s strpbrk wcsncpy_s tolower towlower wcsncpy

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlink _fstat64 _lock_file _wremove _unlock_file

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 strftime _time64

api-ms-win-crt-math-l1-1-0

_dsign __setusermatherr _fdopen

api-ms-win-crt-convert-l1-1-0

strtoull strtoll strtol strtoul strtod atoi wcstombs

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv