crazyrockerror2-20211117T033736Z-001.rar
- SHA256 ab87ee8202ac871a416f6972a6c1b3522728f6412584825fbdc6df9680b1975e
Behavioral task
behavioral1
Sample
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/crazyrockerror2.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
General
- Target crazyrockerror2-20211117T033736Z-001.rar
- Size 25.7MB
- Sample260715-vch1escx21
- SHA256 ab87ee8202ac871a416f6972a6c1b3522728f6412584825fbdc6df9680b1975e
- MD5 45947fa767a63dc9a84bdffe75565933
- SHA1 08521303189f3cbcaf63115da025942a5151d7e6
- SHA512 e205032d27a89f65794fe8e7275b03700f94978c9752987f65d6048483924cc6b2a36e2ffac171d5664d5f18c3b062786a86f194f0a42599a8dc749fc243f64f
- SSDEEP 786432:L8BjMZFLW8kCU/g9Hx5S5hh90T4uAlrmEj1f+TZtX6y6Utsx:aShkjUsh0A/B2TZtX6xUM
- TLSH T1314733F5A243B37DD94E16398126EA0D39E344AAF75002E64A6F6036D3F54EF004BDB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/crazyrockerror2-20211117T033736Z-001/crazyrockerror2/crazyrockerror2.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/crazyrockerror2-20211117T033736Z-001/crazyrockerror2/crazyrockerror2.exe
File Explorer
-
crazyrockerror2-20211117T033736Z-001.rar.rar 25.7MB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/Kitsune---Rock-My-Emotions.mp34.3MB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/Kitsune--Rock-My-Emotions-e.mid14KB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/Thumbs.db9KB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/crazyrockerror2.exe.exe 21.7MB
-
crazyrockerror2.pyc42KB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_77_25.png.png 1KB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_80_25.png.png 1KB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_94_25.png.png 1KB
-
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_95_4.png.png 1KB
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/Kitsune---Rock-My-Emotions.mp3
- SHA256 8f2a6914ac41ff5d48bdea90d0e8b720f90b823e751d22c415524bcfb5b2e07a
- MD5 ead280c91dd57780d9e5eabb341c5cda
- SHA1 8c838ef114c3609d7172435face2b9aae8da85d7
- SHA512 e7c610b698729f53a04d4ee949aba9f6f0a2e324ddd6a62bdf7201c50cb7dc07e968b285e024280d9f0e65cc9e9b042920434643c92298a8581808b75a44553b
- SSDEEP 98304:F01P/YjjxPws0vhQtiGtWNGVjLsYgYTWIn4:eh690vI6NWaUvn4
- TLSH T1A326228A3B11107EB01764BCB3974AA4DA992EC729B4C4C2F977F7C878B718057E0997
- MD5 SHA1 SHA512 SSDEEP TLSH
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/Kitsune--Rock-My-Emotions-e.mid
- SHA256 d988d4ff8fc1086f8f69456b5439b5c8e74de831f1c8ac18155bfddc26b21605
- MD5 2dfca58842ef001e6725046b5346b12d
- SHA1 c33d0cb481ab162643c0b89e3ef824b40f015ac2
- SHA512 327e0c0a3513fc5c2ad4959bd052531642c4603a0b4ed5dc48fdbe694a3ad54ac19384571b51b176290957ae9922de8e3e1437a37aa81b252ed14ddf4381b55f
- SSDEEP 384:u0OtaKUiuq+nrTpKMMegqy7y1y7yhy7yv/ILIqI8cL7f7S+xZ8:udAIupKMMeg/sx8+8
- TLSH T153526BED3060F5C4442B5E909B1BA96530FB3AE397152268470BFEA06F553DFD9338A4
- MD5 SHA1 SHA512 SSDEEP TLSH
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/Thumbs.db
- SHA256 4799137f8f2ab2ec0c8739f952b4bb41fe9e01d957465c951f97706c6027c69c
- MD5 9d867c6057ccfbf6b64a31d6235468e5
- SHA1 3dd651719eb3df2485c2b483cfa02cddf980ae37
- SHA512 005f38454d405a9bf9c4d09d89423739925246d3ba5b418e3af3f3e3881e6abeca4f7376223001c4b70af6e563bd5e21a9dd697ea1cd4c62e14a71cd28928d07
- SSDEEP 192:TDjDOYvam0sHRGO/kqBt0Fu+nCsVDEzbya:TXQ4oOTt/+Cq0bL
- TLSH T141128EDEFB22D821D8E640398F46A584F699BE45A125421F2CC6F30FC831BF4A5C568D
- MD5 SHA1 SHA512 SSDEEP TLSH
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/crazyrockerror2.exe
- IMPHASH d74d76c7011bfcc0cc1ebcb319809a31
- SHA256 402bb037aff01d7848895f63cb066c4690096b9d200493ad31689db809877f72
- MD5 3d659bdd2572999b0a0207f6f5cebfd6
- SHA1 df5ead9e58a1bc09e7d56f726248fbca5991381f
- SHA512 b4d5234ad905ac49d0a8c6f2a8075e79bfd5288471ce946a3cf06b73f3d42deb76ca64c3f1a80cb104061603f90e047e6f8f2b35683d40c2e3648812f3237855
- SSDEEP 393216:0LFjCEDlr+4eq+cZYMS+LBDfPlh2pK/B0J83a10wsP7qsA1x:0LFjCEDjVbZYM19QpSIEaHzBx
- TLSH T1A737334025922114F43CE1B78E768029AEF3B09A83E68D1F185192EA7FD33657E39F57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
35068
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
MessageBoxW
MessageBoxA
kernel32
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
SetDllDirectoryW
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CloseHandle
GetCurrentProcess
LoadLibraryA
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
GetLastError
WriteConsoleW
SetEndOfFile
GetExitCodeProcess
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
GetFileSizeEx
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
HeapSize
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=26715,
count=7, id=259, version=26715,
count=185, id=261, version=26715,
count=3, id=199, version=41118,
count=38, id=261, version=29118,
count=17, id=260, version=29118,
count=9, id=259, version=29118,
count=7, id=257, version=26715,
count=116, id=1, productName=Unmarked objects,
count=16, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=255, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=258, productName=VS2019 v16.8.4 build 29336, version=29336,
crazyrockerror2.pyc
- SHA256 dced848a27bb462893a29f6e3e5af019b38e0db2675ee158c8812213073bebdb
- MD5 4e25497b2f90c51deec5685d83e246f0
- SHA1 706b8239ac73d06d691bc8db9d2437bc9bbe080f
- SHA512 778ea400ad575a5b4daab8c72efc1ff25b12f5a0a44e7c34f2f2feed51c9d9094b3490b87c371bc6b3715520fa71f15d24166ee8283f1c86742222a7b7e7eb9f
- SSDEEP 768:xuI7XBAjQVuerU94BzV1Ku7Sd/tqwXe6XFJ3eMR2VdFQ6jrW3Kdus4jQEt:x5WjQVuersqV1PM1tXe6Xf3eMRmdFFjc
- TLSH T1B4134FEC8055AF4BFD66F7BA2A6D1293AD5033AAD3AFA3171101C59E1B413C48F69D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_77_25.png
- SHA256 96ba706ccb6ceac1ef6add7bd525b0df705c70afaee26cda652fbe12dd1dade0
- MD5 64ae7e30d09c38c1b8fa7cb0948559b3
- SHA1 0d684636fd95d5264649a1ebad835e5114b69a77
- SHA512 5274d2fef186a452ef7f320d76b644cdb63c783a2f356bcf86aa159e77bdbdc6c6a9880d305c5563e86c55a2036d30c90cde9ad80ae689c42ba90d00774f36a4
- TLSH T11331099B5F2BACA5CCE34045AF299326FAEA878720B3675F8809B10451B835099818DE
- MD5 SHA1 SHA512 TLSH
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_80_25.png
- SHA256 e59c206a635d64586a59dfa7c14442f2f35606245e1f5118adb433f312073347
- MD5 023547c81f6ade64b1467c6154b8f857
- SHA1 e3cea0887e7c998e3033b5f019dcc5eaa80a33a6
- SHA512 4d5e6566dc672d75bd1007fcdbc72517bc38d4dda7619cf27b68576c0df815d51ca49ffef8dd9fb9c4e58d12617a4309ac3dc8858e5feb075e7d4ef3d879901a
- TLSH T12321EAD9E6A600DBC4B640384B461696F70D1B9EC74C887D4CC7E4554416338CBD878F
- MD5 SHA1 SHA512 TLSH
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_94_25.png
- SHA256 2d4a7938afa8b3db95c12a1fe3798a607c5a2a8d7d1feeea916e8ad98f00c400
- MD5 b5225cf224fb68a00c1e805b7ecdfa13
- SHA1 574b73b8f8602ff8fb0f3d4b0e7dc05cf084ce9b
- SHA512 15a35ce85974ac513a813bd6543886e5a9482ea32421dc609192cb947ee7125a49ef71716f10550c0a1a73f0cc527b3f7cf867458af584513d422bc60bcd2609
- TLSH T1BA31F7A2E69090045FD9300ABE1B38D9F0EC94D1607C684F168195ADCD329E6F1CCCD8
- MD5 SHA1 SHA512 TLSH
crazyrockerror2-20211117T033736Z-001/crazyrockerror2/imageres_95_4.png
- SHA256 5c411dc18f268e9756261c5c02f41c0932e8bc08105439c41342148d37e77d69
- MD5 497ea29fc41f3a0a06bffb75769bdfa5
- SHA1 e8a1d7065aa1e7006cb87492d3bc22952a835ca4
- SHA512 406e7a28974afb712d2a6df54d5f1a014f572233d876b843356707c04094e897300b9f9685acd0f7e540fe732d1dab3f1934701742358860308447870ad862d2
- TLSH T14F412C5DCB217439F846204D6202B8048513DB0EE215556B8E98E127807EFF9097624F
- MD5 SHA1 SHA512 TLSH