Crossy_Road[.]exe | Triage™

Resubmissions

08/07/2026, 03:46

260708-ebnxaaaz8q8

08/07/2026, 03:43

260708-d93bwsat2t8

Sharing

Copy URL Twitter E-mail

General

Target
Crossy_Road.exe
Size 3.5MB
Sample260708-d93bwsat2t
SHA256 02ffe72f17d61683e15e0b1dd03a064348f92072231f3834a42ebec76c2f81af
MD5 2b5737f7fa5b64c6b1b044f4c4dc01f9
SHA1 256ae51e9d067dedc90eb6f5b0d46052315e6ae2
SHA512 e4404e2d052cccf8ec43603526c93e48beddd4bf3fd112e2eb559607ec5bf7a46873616e7a23662c60ef96968fabfce334f887c9e9e2fef9246df43cfdce4369
SSDEEP 49152:nlXmkyizR9ibXAAbRt1l4QRT/rnCrL+PWN2y8RY5AWGiQnNgTFMD2RvnIxmWRr97:n8ZxvY5A6QJH8vw
TLSH
T17306AE21B6D38037E1BE1971296DD79A91B9BD604E71846F73E82B2E0F318825630F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Crossy_Road.exe

.exe 3.5MB

Crossy_Road.exe

IMPHASH 816d22f6caf18286fc75bb4ac9ea9b94
SHA256 02ffe72f17d61683e15e0b1dd03a064348f92072231f3834a42ebec76c2f81af
MD5 2b5737f7fa5b64c6b1b044f4c4dc01f9
SHA1 256ae51e9d067dedc90eb6f5b0d46052315e6ae2
SHA512 e4404e2d052cccf8ec43603526c93e48beddd4bf3fd112e2eb559607ec5bf7a46873616e7a23662c60ef96968fabfce334f887c9e9e2fef9246df43cfdce4369
SSDEEP 49152:nlXmkyizR9ibXAAbRt1l4QRT/rnCrL+PWN2y8RY5AWGiQnNgTFMD2RvnIxmWRr97:n8ZxvY5A6QJH8vw
TLSH
T17306AE21B6D38037E1BE1971296DD79A91B9BD604E71846F73E82B2E0F318825630F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

0d:87:c5:27:76:0a:d6:86:0e:39:bd:bb:ec:36:41:58:7e:9a:71:ce

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1510420,CN=AI Media Limited,O=AI Media Limited,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Chains

Mar 9, 2020

SERIALNUMBER=1510420,CN=AI Media Limited,O=AI Media Limited,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Digest

98:72:b1:ee:8a:99:fb:44:1c:50:71:06:92:79:9c:62:4f:1a:a4:b5:8a:8f:2e:fd:74:2f:a1:fd:46:81:42:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1510420,CN=AI Media Limited,O=AI Media Limited,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Chains

Mar 9, 2020

SERIALNUMBER=1510420,CN=AI Media Limited,O=AI Media Limited,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

SERIALNUMBER=1510420,CN=AI Media Limited,O=AI Media Limited,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Serial Number

02:00:c4:c3:58:3e:bb:03:5b:0b:a7:f4:6e:74:94:2f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2019 - Apr 22, 2020

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=1510420,CN=AI Media Limited,O=AI Media Limited,L=Tortola,C=VG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025647

Serial Number

0f:6b:2b:c7:62:03:95:d1:2e:d9:05:a3:89:19:72:fe

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2019 - Apr 22, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

878349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap InterlockedDecrement InterlockedIncrement EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId CreateDirectoryW GetSystemDirectoryW FreeLibrary lstrlenW GetVersionExW lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW GetStringTypeW SetUnhandledExceptionFilter FormatMessageW GetEnvironmentVariableW LocalFree LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread SetFilePointer FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent MoveFileW GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle ReadConsoleW

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Crossy_Road.exe

PE Signature issue

kernel32

generic