crack[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
crack.exe
Size 19.2MB
Sample260710-nv1vmaby31
SHA256 625a2424682d6028099df8192c8ada69be63769b3cdcf32819463c02b8531b00
MD5 7b79b84181053e16a977058ef4747397
SHA1 172229813a3a064e8e3f2e37952f432b8f9534c3
SHA512 db2e38754b70c672236b8f0ae8a2d6f2e6a264308994026c9a8b1c15f247022713c47b50c970936ab0ec10dfd5d87ab9ae419b3f4a917928d53818941a5bc278
SSDEEP 393216:v1MUOI1SFXN4Re7Aa/PAfMwT77No6R/af5wNVMWigOnrarw:dM16SFXN77Aa/PwMwH7m0Urarw
TLSH
T1DA17D005367580B2C1AAD138DB87C61AE3307C4697115AEB30D8B6263F73BD68DBF265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
crack.exe

File Explorer

crack.exe

.exe 19.2MB

crack.exe

IMPHASH bac51608266f5e4b03a2750626ed0fd5
SHA256 625a2424682d6028099df8192c8ada69be63769b3cdcf32819463c02b8531b00
MD5 7b79b84181053e16a977058ef4747397
SHA1 172229813a3a064e8e3f2e37952f432b8f9534c3
SHA512 db2e38754b70c672236b8f0ae8a2d6f2e6a264308994026c9a8b1c15f247022713c47b50c970936ab0ec10dfd5d87ab9ae419b3f4a917928d53818941a5bc278
SSDEEP 393216:v1MUOI1SFXN4Re7Aa/PAfMwT77No6R/af5wNVMWigOnrarw:dM16SFXN77Aa/PwMwH7m0Urarw
TLSH
T1DA17D005367580B2C1AAD138DB87C61AE3307C4697115AEB30D8B6263F73BD68DBF265
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b2:ed:0b:d0:bf:5f:e2:67:a6:ec:78:6e:1e:a0:ed:dc:b5:cf:3e:f7

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Synthesia LLC,O=Synthesia LLC,POSTALCODE=48116,STREET=8830 Amboy Dr,L=Brighton,ST=Michigan,C=US

Chains

Feb 27, 2023

CN=Synthesia LLC,O=Synthesia LLC,POSTALCODE=48116,STREET=8830 Amboy Dr,L=Brighton,ST=Michigan,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Synthesia LLC,O=Synthesia LLC,POSTALCODE=48116,STREET=8830 Amboy Dr,L=Brighton,ST=Michigan,C=US

Serial Number

31:e4:e6:2a:03:84:f9:8c:87:b3:6b:d1:e3:07:d0:6a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2020 - Jun 29, 2023

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

3749168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\TeamCityAgent\work\f71b18c76256d81b\build\win\x64\Release\Synthesia.pdb

winmm

midiInClose midiOutOpen midiOutReset midiInAddBuffer midiOutPrepareHeader midiOutLongMsg midiOutUnprepareHeader timeEndPeriod midiOutShortMsg midiInGetNumDevs midiOutGetNumDevs midiInGetDevCapsW midiOutGetDevCapsW midiInOpen midiInPrepareHeader midiInStart midiInStop midiInReset midiOutClose timeBeginPeriod midiInUnprepareHeader

kernel32

GetLocaleInfoEx GlobalAlloc FindFirstFileExW GetCurrentDirectoryW FindClose GetCommandLineW GlobalUnlock GlobalLock DeleteFileA WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW SleepConditionVariableSRW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW GetFileSizeEx SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType FreeLibraryAndExitThread ExitThread CreateThread ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent GetExitCodeThread QueryPerformanceFrequency GetOverlappedResult TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead InitializeCriticalSectionAndSpinCount GetCPInfo LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent RtlPcToFileHeader GetStringTypeW GetFileInformationByHandleEx SetFileInformationByHandle GetFinalPathNameByHandleW FindFirstFileW SetFileAttributesW FindNextFileW GetDiskFreeSpaceExW MultiByteToWideChar WideCharToMultiByte SetLastError GetLastError CreateFileW GetFileTime CloseHandle RaiseException GetProcessAffinityMask GetCurrentProcess SetThreadAffinityMask GetCurrentThread SetThreadPriority SetPriorityClass CreateToolhelp32Snapshot GetCurrentProcessId Process32FirstW Process32NextW GetLongPathNameW CreateMutexW GetVersion GetSystemDirectoryW GetModuleFileNameW GetTempPathW GetTempFileNameW GetUserDefaultUILanguage GetLogicalDrives GetCurrentThreadId FlushFileBuffers SetUnhandledExceptionFilter GetSystemInfo QueryPerformanceCounter VirtualQueryEx FindResourceW SizeofResource LoadResource LockResource FreeResource GetFileSize ReadFile LocalFree OpenProcess VirtualAllocEx WriteProcessMemory GetTickCount64 VirtualFreeEx GetModuleHandleW GetProcAddress Sleep AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx WaitForSingleObject GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileW HeapReAlloc LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile GetTickCount SetEvent CreateEventW ResetEvent GetModuleHandleA CancelIo GetFileInformationByHandle

user32

GetWindowTextW SetForegroundWindow EmptyClipboard SendInput EnableWindow SetClipboardData DialogBoxParamW IsClipboardFormatAvailable GetDlgItem LoadIconW GetClipboardData CloseClipboard OpenClipboard ShowWindow GetWindowLongPtrW SetClassLongPtrW SetWindowTextW EndDialog SendMessageW SetWindowLongPtrW ShowCursor SetCursor SetWindowLongW DispatchMessageW TranslateMessage PeekMessageW UnregisterClassW DestroyWindow ReleaseDC GetClientRect UpdateWindow RegisterTouchWindow GetSystemMetrics CreateWindowExW RegisterClassW LoadCursorW GetMonitorInfoW MonitorFromRect SetProcessDPIAware ScreenToClient CloseTouchInputHandle GetTouchInputInfo GetWindowLongW IsZoomed IsIconic InvalidateRect GetDC ToUnicode SystemParametersInfoW EnumWindows GetWindowThreadProcessId MessageBoxW GetKeyState GetKeyboardState GetWindowRect MapVirtualKeyW PostQuitMessage DefWindowProcW SetWindowPos AdjustWindowRect

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW DragQueryFileW SHCreateDirectoryExW SHFileOperationW ShellExecuteW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

ws2_32

htonl htons ntohs ntohl

dbghelp

MiniDumpWriteDump

wininet

InternetGetConnectedState

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpQueryHeaders WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpen

opengl32

wglMakeCurrent wglCreateContext wglGetProcAddress wglDeleteContext

gdiplus

GdipDeleteMatrix GdipScaleMatrix GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipDisposeImage GdipCreatePen1 GdipDeletePen GdipSetPenWidth GdipSetPenLineCap197819 GdipSetPenLineJoin GdipCloneStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipStringFormatGetGenericTypographic GdipCreatePath GdipDeletePath GdipAddPathString GdiplusShutdown GdipDeleteGraphics GdipGetDC GdipReleaseDC GdipCreateMatrix GdipSetSmoothingMode GdipSetWorldTransform GdipDrawPath GdipGraphicsClear GdipFillPath GdipDrawString GdipMeasureString GdipDeleteFontFamily GdipGetEmHeight GdipGetCellAscent GdipCreateFontFromLogfontW GdipBitmapUnlockBits GdiplusStartup GdipBitmapLockBits GdipCloneBitmapAreaI GdipCreateBitmapFromScan0 GdipCloneImage GdipGetFontSize GdipGetFontStyle GdipGetFamily GdipDeleteFont GdipAlloc GdipSetTextRenderingHint GdipFree GdipGetImageGraphicsContext

gdi32

ChoosePixelFormat SetPixelFormat SwapBuffers GetDeviceCaps GetStockObject

advapi32

RegGetValueW RegCreateKeyExW RegSetValueExW

ole32

CoGetObjectContext CoGetApartmentType OleUninitialize OleInitialize RevokeDragDrop RegisterDragDrop CoLockObjectExternal ReleaseStgMedium CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

890KB

Virtual Size

890KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

171KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14.0MB

Virtual Size

14.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

crack.exe

PE Signature issue

winmm

kernel32

user32

shell32

version

setupapi

ws2_32

dbghelp

wininet

winhttp

opengl32

gdiplus

gdi32

advapi32

ole32

bcrypt

generic