CrackWorld Plugin.rar
- SHA256 5a56a11c2483cfd0777da866cbbae0ccd60defc8e2d18d0a47a4bd155e21a239
Password
CW.FIX
Behavioral task
behavioral1
Sample
CrackWorld Plugin.rar
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
900 seconds
General
- Target CrackWorld Plugin.rar
- Size 22.2MB
- Sample260731-dwct3sshjc
- SHA256 5a56a11c2483cfd0777da866cbbae0ccd60defc8e2d18d0a47a4bd155e21a239
- MD5 6e6158d3570c3b98aef3c246f142e464
- SHA1 027f4465b433a4e9aee14fb4653e44f578bba4b7
- SHA512 0f95e01fe69cc93c4144d32f9333a915030a1df1f913a54a2182b6e5d94a26e590f0ef1546511c960eacc65b985697a3624ca48987a01c475b299f68089b52ca
- SSDEEP 393216:lw+S4XT5DuWZALkKq958CtbuCK7azXgIfviHP7Tx7nOGnqiUrv83pp4tKCTwCLrQ:lwuhZALm5fVfKEgIiHP7Tx68UrE3n4tW
- TLSH T1D637338DCF77A6871B455B05D333FC941B2466267D3A80262F095BEDE9182A6380E3FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/CW Plugin/CWToolsInstaller.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/CW Plugin/CWToolsInstaller.exe
File Explorer
-
CrackWorld Plugin.rar.rar 22.2MB
-
CrackWorld Plugin/CW Plugin.rar.rar 22.2MB
-
CW Plugin/CWToolsInstaller.exe.exe 22.7MB
-
cw_installer.pyc53KB
-
CrackWorld Plugin/Readme.txt603B
CrackWorld Plugin/CW Plugin.rar
- SHA256 738fbc93ad41ce39ad3fa5f28df918d955aa7886813ad411abf91f4a757bf026
- MD5 e8723b0e2b5ca41c1c182eae6940f33e
- SHA1 429c0ad6f39a6f063e85499d7cd3a30ad222f1b9
- SHA512 75017ddb439627bf360909bba1499a17ea78714794f81cd7eb877ce7f9457dd9986da1f74f3fc8b18f0d4e765eb5278a9d9ad4ff7f408e8b820fe84714fb9bf4
- SSDEEP 393216:/w+S4XT5DuWZALkKq958CtbuCK7azXgIfviHP7Tx7nOGnqiUrv83pp4tKCTwCLrT:/wuhZALm5fVfKEgIiHP7Tx68UrE3n4tV
- TLSH T1CC37338DCF77A6871B455B05D333FC941B2466267D3A80262F095BEDE9182A6380E3FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
CW.FIX
CW Plugin/CWToolsInstaller.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 b39c72eb8255bf723c717f40be15df61d745faf1876fe271730f281c1ab9d234
- MD5 94dcd57bc6dc69af7e32f13e2e00e650
- SHA1 284bfae7e2355cacd1d46f558c768c235b1784d3
- SHA512 01c961b66ec9c64662fe8004d1b1db3dfee385c2729ea2e632fc12efe350e88eb8ded5cae3c6c6a02f805859ff2e610a30e19f3c2523268c7fee4a1b47c73e49
- SSDEEP 393216:Q67lNIZ37UJ32eivEoxy8IbdLLK0FYJSrU4tZq5X/6Z/SHsxtEDweGCW1lQo:QybS4ce2sndXzrFtZq5w/Qwt7el8
- TLSH T1A63733C577850876ECD273386EDA8E63E392B42107608AAF1BB01D396E931DC9D3C765
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
CW.FIX
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
cw_installer.pyc
- SHA256 646d42d1bda85bc3e2e9fdbbaa7439a260849b0bd8586b0fcdbb078d498ea54a
- MD5 d4ccb00e4e9e0b247315cd310a0f7963
- SHA1 c6793c2f7e19a2d0651375c5aa873e755c2efd99
- SHA512 ecbb52b4caca025c92e9dd4c8d3848b37d6148b6aaf3fff9af934718149545438d92d92af54c5fd03be8fd85dc4c446b34ded072f807bef57b8006edddc69de1
- SSDEEP 768:MibHI1TV+mha5RxZbAcgvpZq9mhmgEq/vYDTj:MMjga5PMRY94EEW/
- TLSH T14F33F6B4E830A517FCADF27931EBA991B32542827250C607E1349DBE7DDA761C82931F
- MD5 SHA1 SHA512 SSDEEP TLSH
CrackWorld Plugin/Readme.txt
- SHA256 64da42d9710c2ece24fcf5f875573fdf53ea5d57bed2ffa79182c4ecbe803061
- MD5 b78eb6cb1fc28cda4100150bdbd313c9
- SHA1 e06850d382424182376395072e9cf7473b9365da
- SHA512 82631b65dae16a492b6be254d09e0f9599bad936288e126cf7e3351c37669c2fb184b66cca7a2eada255aa189c1b994a97226986d78f031219c6b1bc49ab7142
- TLSH T16AF0E17F6FD392A017A427E81A9F68E2F31018AC76A84369B61913453E280A05A10ADF
- MD5 SHA1 SHA512 TLSH