Unconfirmed 185982[.]crdownload

Sharing

Copy URL Twitter E-mail

General

Target
Unconfirmed 185982.crdownload
Size 1.6MB
Sample260804-mkcjlsxgpg
SHA256 e55b0d7f644022478d39f2aa5685004ac3ef808a708428be40304957f4935702
MD5 a53aa351e6406678410f8290f7ab0e22
SHA1 d15d889a475d62ef52900db9a804866cfe74ab9b
SHA512 aefa624b81ae0aec9d02044c9cf5ba08b083f8de0ec8103f1df15bfe5c97568d312124370fc4b79f8c62d329ba12678becff7cbe466a350c5ae30005d300065c
SSDEEP 49152:PHHK5GbFYLcmzKTUPThTnDOpfwaUaQCb:/b+xrJOT
TLSH
T10C75CF95F7E642E9C0AAC2789D62EA27DA71384803348BEB13D15579DF776D00E3EE10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Unconfirmed 185982.crdownload

File Explorer

Unconfirmed 185982.crdownload

.dll 1.6MB

Unconfirmed 185982.crdownload

IMPHASH 022d22245390acb99e79266e6bb23dbc
SHA256 e55b0d7f644022478d39f2aa5685004ac3ef808a708428be40304957f4935702
MD5 a53aa351e6406678410f8290f7ab0e22
SHA1 d15d889a475d62ef52900db9a804866cfe74ab9b
SHA512 aefa624b81ae0aec9d02044c9cf5ba08b083f8de0ec8103f1df15bfe5c97568d312124370fc4b79f8c62d329ba12678becff7cbe466a350c5ae30005d300065c
SSDEEP 49152:PHHK5GbFYLcmzKTUPThTnDOpfwaUaQCb:/b+xrJOT
TLSH
T10C75CF95F7E642E9C0AAC2789D62EA27DA71384803348BEB13D15579DF776D00E3EE10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

746316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\xvqct\Downloads\zephyr-main\source\x64\Release\Floence.pdb

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW GetProcAddress LockResource DisableThreadLibraryCalls GetModuleHandleW FreeLibrary GetModuleHandleA FreeLibraryAndExitThread LoadResource SizeofResource

api-ms-win-core-memory-l1-1-0

VirtualProtect VirtualAlloc VirtualQuery VirtualFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l1-1-0

CreateFileA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetCurrentThreadId CreateThread GetCurrentProcess SuspendThread OpenThread ResumeThread

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryA

d2d1

ord1

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-heap-l2-1-0

GlobalFree GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

d3dcompiler_47

D3DCompile

api-ms-win-core-localization-l1-2-0

GetLocaleInfoA

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-heap-l1-1-0

HeapCreate HeapFree HeapReAlloc GetProcessHeap HeapAlloc

api-ms-win-core-toolhelp-l1-1-0

Thread32First CreateToolhelp32Snapshot Thread32Next

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache SetThreadContext GetThreadContext

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??0facet@locale@std@@IEAA@_K@Z ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1facet@locale@std@@MEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Cnd_do_broadcast_at_thread_exit ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z _Query_perf_counter _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Xtime_get_ticks ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

user32

DestroyWindow UnregisterClassW RegisterClassExW DefWindowProcW ScreenToClient ClientToScreen GetKeyState CreateWindowExW GetKeyboardLayout LoadCursorW GetAsyncKeyState GetDpiForWindow GetWindowRect SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos GetClientRect SetCursor GetForegroundWindow

kernel32

AreFileApisANSI SetFileInformationByHandle WakeAllConditionVariable GetFileAttributesExW SleepConditionVariableSRW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead GetFileInformationByHandleEx RtlCaptureContext ReleaseSRWLockExclusive AcquireSRWLockExclusive RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy _CxxThrowException strstr __std_terminate __C_specific_handler __std_type_info_destroy_list __current_exception memset __std_exception_copy __std_exception_destroy memcmp memchr __current_exception_context memmove

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _wfopen fputc fsetpos feof _get_stream_buffer_pointers setvbuf ftell fgetpos __stdio_common_vsprintf fopen_s __stdio_common_vfprintf fwrite ferror __acrt_iob_func fread _fseeki64 fgetc __stdio_common_vsprintf_s fflush fseek fclose ungetc

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _errno terminate _invalid_parameter_noinfo abort _initterm_e _initterm _cexit _invalid_parameter_noinfo_noreturn _crt_atexit _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _beginthreadex

api-ms-win-crt-heap-l1-1-0

free realloc malloc _callnewh calloc

api-ms-win-crt-string-l1-1-0

toupper strncmp tolower iswspace isdigit strcmp

api-ms-win-crt-math-l1-1-0

_dclass _dsign acosf atan2f _fdsign ceilf _hypotf fmodf pow cos _fdclass _ldsign powf sin floorf fmaxf sinf fminf cosf sqrtf ldexp _ldclass

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtod strtoull

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-environment-l1-1-0

_dupenv_s

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList