testcrack[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
testcrack.exe
Size 4.4MB
Sample260722-rl1eaafg22
SHA256 b0d079ff0b444274ac28fbf907f14bd84d38d873486ee73c13a36675fa367b21
MD5 f99e8b13122e724862016eed1d08aa8a
SHA1 f5b4974fd78ed902a51815f6f8e7e4977493f4ce
SHA512 6ac75cbbfc3e08c5938ad68a4a5e4caed5425d6ba047b47d7a058b91655d755eb5fe8734aa36b348937ed8e5e9583bd359fd38bc9efda430bd0d7bac66480611
SSDEEP 98304:ScvKwAVCJvbHto/Y7mgTm05AwJHE6hRJwlZqL9PlFG:5KwthjKg7PAmkG6ZqL1lF
TLSH
T19726AE82F392C599C26A8138CA56D7A7D7323C081F2157EB369CBE5A3F726D00E75742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
testcrack.exe

File Explorer

testcrack.exe

.exe 4.4MB

testcrack.exe

IMPHASH 82e69aa792a4fef93844f20b54002c5d
SHA256 b0d079ff0b444274ac28fbf907f14bd84d38d873486ee73c13a36675fa367b21
MD5 f99e8b13122e724862016eed1d08aa8a
SHA1 f5b4974fd78ed902a51815f6f8e7e4977493f4ce
SHA512 6ac75cbbfc3e08c5938ad68a4a5e4caed5425d6ba047b47d7a058b91655d755eb5fe8734aa36b348937ed8e5e9583bd359fd38bc9efda430bd0d7bac66480611
SSDEEP 98304:ScvKwAVCJvbHto/Y7mgTm05AwJHE6hRJwlZqL9PlFG:5KwthjKg7PAmkG6ZqL1lF
TLSH
T19726AE82F392C599C26A8138CA56D7A7D7323C081F2157EB369CBE5A3F726D00E75742
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1354680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\lolha\Downloads\tc\tc - Copy - Copy - Copy\build\repent.life.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock Sleep SwitchToThread GetConsoleWindow GetCurrentProcess GetCurrentThread RaiseException GetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent SetThreadPriority ReadProcessMemory SetConsoleTextAttribute SetConsoleTitleA GetStdHandle SetConsoleMode SetCurrentConsoleFontEx ExpandEnvironmentStringsA GetVolumeInformationA GetConsoleMode GetLastError Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle CreateFileA GetModuleHandleA ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA InitializeSListHead GetLocaleInfoEx GetSystemTimeAsFileTime CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW FormatMessageA LocalFree InitOnceBeginInitialize InitOnceComplete GetTickCount64 GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared GetFileInformationByHandleEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetLocaleInfoA AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileSizeEx SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId

user32

GetCursorPos GetAsyncKeyState PostQuitMessage GetClipboardData MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow SetWindowLongA MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetDC LoadCursorA TranslateMessage PeekMessageA UnregisterClassA EmptyClipboard RegisterClassExA UpdateWindow GetWindowThreadProcessId IsWindow EnumWindows GetSystemMetrics FindWindowExA GetWindowTextA SetWindowDisplayAffinity IsWindowVisible ShowWindow FindWindowA SendInput OpenClipboard CloseClipboard GetMessageExtraInfo SetClipboardData GetKeyState

gdi32

BitBlt CreateCompatibleBitmap GetDeviceCaps DeleteDC CreateCompatibleDC SelectObject DeleteObject

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteW

ole32

CreateStreamOnHGlobal CLSIDFromString PropVariantClear

msvcp140

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Syserror_map@std@@YAPEBDH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Cnd_broadcast ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Random_device@std@@YAIXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Thrd_id _Thrd_join ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpSendRequest WinHttpQueryHeaders WinHttpOpenRequest WinHttpConnect WinHttpReadData WinHttpReceiveResponse WinHttpCrackUrl WinHttpSetTimeouts WinHttpSetOption WinHttpAddRequestHeaders

winmm

timeBeginPeriod PlaySoundA

gdiplus

GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusShutdown GdipSaveImageToStream GdipFree GdiplusStartup

mfplat

MFShutdown MFCreateSourceResolver MFStartup

mf

MFGetService MFCreateMediaSession MFCreateTopologyNode MFCreateAudioRendererActivate MFCreateTopology

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr strchr _purecall __C_specific_handler strrchr longjmp memcpy memmove memset memchr memcmp __current_exception __current_exception_context __intrinsic_setjmp __std_exception_copy __std_exception_destroy __std_terminate _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc realloc free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type abort _get_initial_narrow_environment _initterm _initterm_e _exit _errno __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback exit system _invoke_watson _beginthreadex terminate

api-ms-win-crt-math-l1-1-0

fmaxf fminf pow powf sin sinf sqrtf fmodf logf cosf cos ceilf atan2f asinf roundf nearbyint ldexp __setusermatherr acosf _fdclass tanf

api-ms-win-crt-string-l1-1-0

isalnum tolower strncpy_s wcscpy_s strcpy_s strncmp _stricmp strncpy strcmp

api-ms-win-crt-stdio-l1-1-0

__p__commode _wfopen __stdio_common_vsprintf __stdio_common_vsprintf_s fread ftell __acrt_iob_func __stdio_common_vfprintf fflush fclose __stdio_common_vsscanf _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _set_fmode fgetc fputc fwrite fseek

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof strtoull strtol atoi strtof

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

strftime _time64 _localtime64_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale