UnityCrashHandler64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
UnityCrashHandler64.exe
Size 1.1MB
Sample260723-ccd3csfb48
SHA256 a76ba1f83d325fd246b652395ce46b1f311e77e60cf4e23e9b16d0f24d24e94e
MD5 8b3a2c4b34e357f8f31232d20e9e045c
SHA1 b4c4a124454b93445bad57cf5eb76fec016c2e46
SHA512 fb14ad48bf1b888a3ff29fa887e1985903f9b5a4da671b245a37a6c3c3f51a79a930ac6addd14559bfdca5ddaa276c45af54829d2d2cf70e932f121709017c9a
SSDEEP 12288:zo4M8g5CFF3vK3YjRJKC1Zj4xl6PwsinRZw2mtxb4TRq7QsoPo4nHcKylQfz2fzS:zo4fg5CFWYii0zRZw2mX0M/wn0Kz+zAt
TLSH
T1D2457C6A66A800E9D5779135C952490FE7F27C1907609BDF23A0B7A72F336E41E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

UnityCrashHandler64.exe

.exe 1.1MB

UnityCrashHandler64.exe

IMPHASH 7b3f6a90eb536eecf8860677e4cd17a0
SHA256 a76ba1f83d325fd246b652395ce46b1f311e77e60cf4e23e9b16d0f24d24e94e
MD5 8b3a2c4b34e357f8f31232d20e9e045c
SHA1 b4c4a124454b93445bad57cf5eb76fec016c2e46
SHA512 fb14ad48bf1b888a3ff29fa887e1985903f9b5a4da671b245a37a6c3c3f51a79a930ac6addd14559bfdca5ddaa276c45af54829d2d2cf70e932f121709017c9a
SSDEEP 12288:zo4M8g5CFF3vK3YjRJKC1Zj4xl6PwsinRZw2mtxb4TRq7QsoPo4nHcKylQfz2fzS:zo4fg5CFWYii0zRZw2mX0M/wn0Kz+zAt
TLSH
T1D2457C6A66A800E9D5779135C952490FE7F27C1907609BDF23A0B7A72F336E41E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

fb:71:4f:44:ce:b6:c5:db:e8:44:1c:de:33:6a:6e:8e:c3:ff:fb:0b:06:f9:bc:74:87:ed:82:7f:9b:76:8a:23

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 24, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

03:e6:cb:30:35:09:9e:63:9e:f3:35:ea:cd:37:c0:1f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2023 - Jun 8, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

305840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\output\unity\unity\artifacts\UnityCrashHandler\Win64_VS2019_nondev_i_m\UnityCrashHandler64.pdb

user32

SetWindowPos SetForegroundWindow LookupIconIdFromDirectoryEx GetDlgItem SendDlgItemMessageA AdjustWindowRect GetWindowLongA DialogBoxParamA SetWindowTextW OffsetRect EndDialog SendMessageW UnionRect GetIconInfo LoadImageA CreateIconFromResourceEx InflateRect

kernel32

DuplicateHandle VirtualProtect GetVersionExW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SignalObjectAndWait CreateTimerQueue WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FlsFree FlsSetValue FlsGetValue FlsAlloc FreeLibraryAndExitThread GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler GetFileType SetStdHandle GetModuleHandleExW ExitProcess RtlPcToFileHeader InterlockedFlushSList SetWaitableTimer GetModuleHandleA GetLastError GetCurrentThread WaitForSingleObjectEx CloseHandle RaiseException GetProcAddress SleepEx GetThreadTimes CreateWaitableTimerExW OpenThread TryEnterCriticalSection EnterCriticalSection SetThreadPriority InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetCurrentThreadId ResumeThread GetThreadPriority CreateThread SwitchToThread DeleteCriticalSection CreateDirectoryW ReadFile GetModuleFileNameA FindFirstFileW FindFirstFileExW TlsSetValue SetLastError RtlCaptureContext GetFullPathNameW FindNextFileW GetCurrentProcess WriteFile OutputDebugStringA RemoveDirectoryW RtlVirtualUnwind SetFileTime GetModuleFileNameW RtlLookupFunctionEntry SetFilePointer SetEndOfFile QueryDepthSList FindClose CreateFileW GetFileAttributesW SuspendThread GetCurrentDirectoryA SetFileAttributesW CreateEventW MultiByteToWideChar GetFileAttributesA GetFileAttributesExW GetDiskFreeSpaceExW LoadLibraryA DeleteFileW LoadLibraryW GetThreadContext SetFilePointerEx MoveFileExW ReplaceFileW ReadProcessMemory SystemTimeToFileTime FreeLibrary CopyFileW WideCharToMultiByte TlsGetValue GetTempFileNameW GetSystemTime FlushFileBuffers HeapFree Thread32Next Thread32First WaitForSingleObject CreateToolhelp32Snapshot FormatMessageW HeapAlloc LocalFree VerSetConditionMask GetCurrentProcessId GetProcessHeap GetModuleHandleW VerifyVersionInfoW GetSystemTimeAsFileTime GetStdHandle TerminateProcess GetProcessId GetTempPathW WaitForMultipleObjectsEx OpenProcess Sleep SetEvent GetThreadId GetFileSize CreateProcessW CopyFileExW AllocConsole GetExitCodeProcess SizeofResource GetCommandLineW EnumResourceNamesA InitializeCriticalSection SetErrorMode FindResourceA GetExitCodeThread TerminateThread LockResource LoadResource CreateEventA LoadLibraryExW GetFileSizeEx CreateSemaphoreExW VirtualFree ReleaseSemaphore VirtualAlloc TlsAlloc QueryPerformanceFrequency TlsFree QueryPerformanceCounter IsDebuggerPresent InterlockedPushEntrySList RtlUnwindEx GetLocaleInfoW LCMapStringW CompareStringW GetTickCount GetCPInfo DecodePointer EncodePointer GetStringTypeW InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent UnregisterWaitEx InterlockedPopEntrySList GetEnvironmentVariableA

dbghelp

SymRegisterFunctionEntryCallback64 SymLoadModuleEx

shell32

SHGetKnownFolderPath SHCreateDirectoryExW CommandLineToArgvW SHFileOperationW

ole32

CoTaskMemFree CoInitializeEx CoCreateGuid

shlwapi

PathCanonicalizeW

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetCrackUrlA HttpQueryInfoA HttpOpenRequestA

gdi32

GetObjectA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

Name

.text

Size

582KB

Virtual Size

582KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

349KB

Virtual Size

349KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

UnityCrashHandler64.exe

user32

kernel32

dbghelp

shell32

ole32

shlwapi

psapi

advapi32

wininet

gdi32

version

generic