travelers_cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
travelers_cracked.exe
Size 2.7MB
Sample260714-b2cedsct2r
SHA256 0d77e69db97dc7d4e80762cdc020e8c415e3dc4c80b72b7058203915fed672a6
MD5 ef8a50fc4788953f2f69a604ae28e41e
SHA1 ebc5c6eb8d2900eeaee67e53b8ac6b0a4addc49f
SHA512 ebb9237fac321e83cce9f39c287e4df41a40fb4ea74b1b29b98522f37c610a02a3374de4bbb301fc8a40dabba5041f5a8b525dd4446363b6e57aa07d31fe9620
SSDEEP 49152:1b1GMRApj3Z/aNcJhm26iCUndQGnZhuB5fVmsD+:GXRZ/aNr2r3
TLSH
T102D57DE69BF841E8F16ED074C4165217E36238242B30DEEB1BA44D119F7FAD6C7B5A80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
travelers_cracked.exe

File Explorer

travelers_cracked.exe

.exe 2.7MB

travelers_cracked.exe

IMPHASH 02d5d7629647e600136d3f41b8624275
SHA256 0d77e69db97dc7d4e80762cdc020e8c415e3dc4c80b72b7058203915fed672a6
MD5 ef8a50fc4788953f2f69a604ae28e41e
SHA1 ebc5c6eb8d2900eeaee67e53b8ac6b0a4addc49f
SHA512 ebb9237fac321e83cce9f39c287e4df41a40fb4ea74b1b29b98522f37c610a02a3374de4bbb301fc8a40dabba5041f5a8b525dd4446363b6e57aa07d31fe9620
SSDEEP 49152:1b1GMRApj3Z/aNcJhm26iCUndQGnZhuB5fVmsD+:GXRZ/aNr2r3
TLSH
T102D57DE69BF841E8F16ED074C4165217E36238242B30DEEB1BA44D119F7FAD6C7B5A80
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1373740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoInitializeEx CoUninitialize

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpSetOption WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpSendRequest WinHttpConnect WinHttpSetTimeouts WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpen

shlwapi

StrStrIW

crypt32

CryptBinaryToStringW

kernel32

TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId InitOnceBeginInitialize InitOnceComplete MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GetEnvironmentVariableA CompareFileTime FindFirstFileW FindNextFileW FindClose GetFileAttributesW GetFileAttributesExW GetCurrentThreadId WriteFile SetUnhandledExceptionFilter WaitForSingleObject CreateFileW GetLastError CloseHandle SetThreadPriority Sleep GetCurrentThread GetProcessId CreateToolhelp32Snapshot Module32FirstW VirtualProtectEx Module32NextW GetTickCount64 Process32First Module32Next Module32First OpenProcess Process32Next GetExitCodeProcess ReadFile QueryFullProcessImageNameA GetFileSize GetModuleFileNameW GetTempPathW SetFileAttributesW DeleteFileW GetWindowsDirectoryW MoveFileExW CreateProcessW GetSystemTimeAsFileTime GetTickCount SleepConditionVariableSRW InitializeSListHead GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetEnvironmentVariableW AcquireSRWLockExclusive RtlCaptureContext ReleaseSRWLockExclusive CreateDirectoryW

user32

MonitorFromPoint DispatchMessageA DestroyWindow SetWindowPos EnumDisplayMonitors CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DefWindowProcW SetWindowLongA SetWindowDisplayAffinity GetMonitorInfoA SetLayeredWindowAttributes TranslateMessage PeekMessageA PostQuitMessage FindWindowA UpdateWindow SystemParametersInfoA CharUpperW GetKeyboardState IsWindow GetKeyNameTextA GetAsyncKeyState MapVirtualKeyA SetFocus SetForegroundWindow GetAncestor GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC SendInput GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

gdi32

GetDeviceCaps

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegEnumValueW RegDeleteValueW

shell32

ShellExecuteExW SHCreateDirectoryExW ShellExecuteW ShellExecuteA

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Thrd_join _Thrd_id ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?uncaught_exceptions@std@@YAHXZ ?_Random_device@std@@YAIXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock _Query_perf_frequency _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

ws2_32

accept bind closesocket select listen setsockopt WSAStartup send WSACleanup socket recv htonl htons

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler memcpy __current_exception_context memmove __current_exception memset memcmp memchr wcsrchr __std_exception_copy __std_exception_destroy __std_terminate strstr strchr

api-ms-win-crt-stdio-l1-1-0

fwrite __stdio_common_vsnwprintf_s __acrt_iob_func _wfopen __p__commode __stdio_common_vsprintf fread ftell __stdio_common_vswprintf_s _set_fmode _get_stream_buffer_pointers __stdio_common_vfprintf _fseeki64 __stdio_common_vsscanf fsetpos _wfopen_s fgetpos fseek fclose fputc feof ungetc fopen_s fgetc setvbuf ferror fflush

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp isxdigit isdigit strcmp tolower _wcsicmp wcscpy_s _stricmp strncpy wcsncpy_s wcscat_s isspace strncat toupper

api-ms-win-crt-heap-l1-1-0

realloc free _callnewh _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_errno _invoke_watson _beginthreadex _c_exit abort _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_narrow_winmain_command_line _initterm _initterm_e exit _exit

api-ms-win-crt-convert-l1-1-0

strtoull atoi atof strtol strtof strtod

api-ms-win-crt-math-l1-1-0

floorf fmodf ceilf tanf pow ldexp atan2f sqrtf cosf asinf acosf expf _hypotf sinf lroundf __setusermatherr _fdclass roundf floor round nearbyint

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale