SYSKING CRACKED BY FEUD[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SYSKING CRACKED BY FEUD.exe
Size 545KB
Sample260802-za16fafd35
SHA256 4a6dfde602d9fb75afdd5de0d604ccffafd96faf4fb0adf1e0b7b9b2a7798059
MD5 de0ddcc560bb7a20beed95941f415270
SHA1 0206962a3c01c3f96c328216960e5404a724382c
SHA512 bbf05b9231bf3c5ced8d399fa555f6e3e8adc05908cdc7f900609689e60431f28a4b33ac2e2bee7d2fd96b5e67cbb602ddcb4d4b9d9db126bb19fe73055743ad
SSDEEP 12288:qwVZGH+Le8pbPCRIhvwbVwjnj+bm68lNpcipn7bV5:ib6OUmGrjA8lNyipn7
TLSH
T1F8C4AF41F1B863F8D02F91389656A61FFF753898135059DB53E088A82FE37E15BBE242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SYSKING CRACKED BY FEUD.exe

File Explorer

SYSKING CRACKED BY FEUD.exe

.exe 545KB

SYSKING CRACKED BY FEUD.exe

IMPHASH 4123b35fbd71f343436b3c5f0f7af057
SHA256 4a6dfde602d9fb75afdd5de0d604ccffafd96faf4fb0adf1e0b7b9b2a7798059
MD5 de0ddcc560bb7a20beed95941f415270
SHA1 0206962a3c01c3f96c328216960e5404a724382c
SHA512 bbf05b9231bf3c5ced8d399fa555f6e3e8adc05908cdc7f900609689e60431f28a4b33ac2e2bee7d2fd96b5e67cbb602ddcb4d4b9d9db126bb19fe73055743ad
SSDEEP 12288:qwVZGH+Le8pbPCRIhvwbVwjnj+bm68lNpcipn7bV5:ib6OUmGrjA8lNyipn7
TLSH
T1F8C4AF41F1B863F8D02F91389656A61FFF753898135059DB53E088A82FE37E15BBE242
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

442264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\worse\Desktop\auth\loaders2\x64\Release\loaders.pdb

d3d9

Direct3DCreate9

kernel32

GetFileAttributesA Process32NextW DeleteFileA Process32FirstW CloseHandle ExitProcess CreateDirectoryA ConnectNamedPipe OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetTickCount64 LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GetVolumeInformationA GetCurrentThreadId GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLastError GetTempPathA Sleep CreateToolhelp32Snapshot CreateFileW InitializeSListHead CreateNamedPipeW TerminateProcess WriteFile GetCurrentProcess SetInformationJobObject GetModuleFileNameA ReadFile GetModuleHandleW GetSystemTimeAsFileTime GetLocaleInfoA

user32

AdjustWindowRectEx GetKeyState GetMessageExtraInfo SetPropA GetDC MonitorFromWindow SetWindowLongPtrW EnumDisplayMonitors ScreenToClient WindowFromPoint GetCapture GetMonitorInfoW SetForegroundWindow ClientToScreen IsChild TrackMouseEvent GetKeyboardLayout GetForegroundWindow GetPropA SetLayeredWindowAttributes BringWindowToTop LoadCursorW SetCapture SetCursor SetWindowLongW GetClientRect IsWindowUnicode IsIconic SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SendMessageW MessageBoxA ReleaseCapture DefWindowProcW DestroyWindow GetWindowLongW UpdateWindow PostQuitMessage TranslateMessage SetFocus PeekMessageW DispatchMessageW ShowWindow UnregisterClassW CreateWindowExW SetActiveWindow SetWindowPos RegisterClassExW

gdi32

GetDeviceCaps

advapi32

FreeSid AdjustTokenPrivileges CheckTokenMembership LookupPrivilegeValueW OpenProcessToken AllocateAndInitializeSid

shell32

ShellExecuteA ShellExecuteW

msvcp140

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle

urlmon

URLDownloadToFileA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memset memcmp memchr __std_terminate __current_exception __current_exception_context _CxxThrowException __C_specific_handler __std_exception_copy __std_exception_destroy memcpy

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback exit _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _beginthreadex system _set_app_type _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

ungetc fgetpos __stdio_common_vsscanf fwrite __stdio_common_vsprintf _set_fmode _wfopen __stdio_common_vfprintf fseek __acrt_iob_func __p__commode fgetc fputc ftell fclose _get_stream_buffer_pointers fflush _fseeki64 fread fsetpos setvbuf

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

strlen strcmp strcpy_s _stricmp wcslen strncpy strncmp

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

sqrtf fmodf acosf ceilf sinf cosf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale