Z3RT[.]UD_CRACKED[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Z3RT.UD_CRACKED.exe
Size 2.7MB
Sample260804-yzt8ragd23
SHA256 c2c9e8231596250e847158c6a77144e6728df3d166b403803b32aa9280ab6f04
MD5 f5c22f570fc75f5fd133fed20090d503
SHA1 ccde1c1e73e19590d147c25372e29c458c00ea9e
SHA512 04138ed75b554ce9cb304db70736e2a5171c57372d93665bdbbf3e3311afa27c320eebef92b3551a0612f80898fea067e1605e8017cd601b589bcb4cb451ea2c
SSDEEP 49152:CHea7oc6CAJIzVDjr1tN7pDyptqaCHrQwZxsdpEcW0Erv5nD96TZDZXAABm:bpcZAgrgtqaCHrQwZxsdpZma5VA/
TLSH
T1FDD5CF47A3A502ECC667913CC2169317E3B27809132097DF67E48AA91F53AE06FFE751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Z3RT.UD_CRACKED.exe

File Explorer

Z3RT.UD_CRACKED.exe

.exe 2.7MB

Z3RT.UD_CRACKED.exe

IMPHASH fc93ec4ce005aa4a7236a03dd9731774
SHA256 c2c9e8231596250e847158c6a77144e6728df3d166b403803b32aa9280ab6f04
MD5 f5c22f570fc75f5fd133fed20090d503
SHA1 ccde1c1e73e19590d147c25372e29c458c00ea9e
SHA512 04138ed75b554ce9cb304db70736e2a5171c57372d93665bdbbf3e3311afa27c320eebef92b3551a0612f80898fea067e1605e8017cd601b589bcb4cb451ea2c
SSDEEP 49152:CHea7oc6CAJIzVDjr1tN7pDyptqaCHrQwZxsdpEcW0Erv5nD96TZDZXAABm:bpcZAgrgtqaCHrQwZxsdpZma5VA/
TLSH
T1FDD5CF47A3A502ECC667913CC2169317E3B27809132097DF67E48AA91F53AE06FFE751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1429332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\RAT\Desktop\Sources\Brook Temp SRC\x64\Release\SAPPHIRE-TEMP.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

UnhandledExceptionFilter InitializeSListHead RtlVirtualUnwind HeapDestroy OutputDebugStringW RtlLookupFunctionEntry RtlCaptureContext MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask WakeAllConditionVariable AddVectoredExceptionHandler CreateFileW CreateFileMappingA GetCurrentThreadId SleepConditionVariableSRW GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FreeLibrary QueryPerformanceCounter GetSystemTimeAsFileTime LoadLibraryW GetModuleHandleW GetConsoleWindow AllocConsole ReadFile WaitForSingleObject FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA VerifyVersionInfoW GetCurrentProcessId WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW GetTickCount GetSystemInfo SleepEx GetSystemDirectoryW LocalFree LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleFileNameW GetModuleFileNameA CreateFileMappingW Sleep GetLastError CloseHandle CreateProcessW CreateProcessA VirtualProtect CreateThread GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx CreateFileA GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile HeapSize SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess CreatePipe IsProcessorFeaturePresent

user32

CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos ReleaseCapture EmptyClipboard GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow TrackMouseEvent GetClipboardData SetClipboardData IsWindowUnicode RegisterClassExW GetCapture ScreenToClient GetDC GetKeyState MoveWindow GetWindowRect ShowWindow UpdateWindow PostQuitMessage TranslateMessage SetLayeredWindowAttributes PeekMessageW SetWindowLongA DispatchMessageW MessageBoxW MessageBoxA GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW ClientToScreen

gdi32

DeleteDC SelectObject CreateCompatibleBitmap BitBlt CreateCompatibleDC DeleteObject

advapi32

CryptEncrypt OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptHashData CryptDestroyHash CryptImportKey CryptDestroyKey CryptCreateHash CryptGetHashParam SystemFunction036

ole32

CreateStreamOnHGlobal

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

msvcp140

_Query_perf_counter _Query_perf_frequency ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z _Xtime_get_ticks ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

gdiplus

GdipDisposeImage GdipGetImageEncodersSize GdiplusStartup GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdipSaveImageToStream GdipFree

winhttp

WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpCrackUrl

crypt32

CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertFreeCertificateChainEngine CertCloseStore CertOpenStore CertGetCertificateChain CertFreeCertificateChain CertCreateCertificateChainEngine CertEnumCertificatesInStore

ws2_32

WSAEnumNetworkEvents WSACreateEvent WSAWaitForMultipleEvents WSACloseEvent WSAResetEvent WSAEventSelect getsockopt closesocket send accept WSAGetLastError inet_pton gethostname ntohs ioctlsocket sendto recvfrom WSASetLastError freeaddrinfo inet_ntop getaddrinfo listen htonl bind WSAStartup WSACleanup select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strstr strrchr longjmp memcpy memmove memset memchr __intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception wcschr strchr _CxxThrowException memcmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode fwrite _wfopen __stdio_common_vsprintf _wopen fread __stdio_common_vsscanf feof fputs __p__commode fputc _read fclose _write _fileno _close __stdio_common_vfprintf fflush ftell __acrt_iob_func _get_stream_buffer_pointers _fseeki64 _pclose fsetpos fgetc ungetc _popen fseek setvbuf fgetpos _lseeki64 fgets

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo terminate _invalid_parameter_noinfo_noreturn _beginthreadex __sys_errlist __sys_nerr _invoke_watson abort _resetstkoflw system exit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _errno _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-string-l1-1-0

strncmp strcmp _strdup tolower wcsncpy _wcsdup strncpy strcspn wcspbrk strspn strpbrk wcsncmp

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free realloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtoll atoi strtoull strtoul strtod wcstombs strtol

api-ms-win-crt-math-l1-1-0

sqrtf sinf __setusermatherr acosf ceilf cosf fmodf powf _dsign _fdopen

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _time64 _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _fstat64 _lock_file _unlock_file _unlink

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

shell32

ShellExecuteA