cracked[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cracked.zip
Size 16.5MB
Sample260806-xej2lsybme
SHA256 cf4af9742230d2e28f40812f6fc29aecdd7721080c936c7e027e203efee8fcdc
MD5 74f62ec84d8392d0f16f705b987702b3
SHA1 036cfc4d922a95990262e071a5efd984eef1b3f2
SHA512 2f7df77f353f9d03cec42d3da30097a7be377928048ff6ca6403cc21770a58f3f5f1dc46c1d77b89bc52d027e4eaaa072c25fb3411a582fe3f7ec0397c900225
SSDEEP 393216:IZqVOsLf68YNBgT2DxHZ9nPKGMgqrxK6TGJAP24NPjeBjkJiR4uMqQ:IcMWAg67L2RTo6B6BbR4uMqQ
TLSH
T1DA0733290A847C10ED94DB8C324860EB977590A1FD964EC9930F6A06ECCB59F673FCE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cracked/Loader.exe
unpack001/cracked/Madium-Module.dll
unpack001/cracked/Madium.authspoof.exe
unpack001/cracked/RUNTHIS.exe
unpack001/cracked/lsp/luau-lsp.exe

File Explorer

cracked.zip

.zip 16.5MB
cracked/Loader.exe

.exe 298KB
cracked/Madium-Module.dll

.dll 7.8MB
cracked/Madium.authspoof.exe

.exe 12.0MB
cracked/RUNTHIS.exe

.exe 6KB
cracked/lsp/luau-lsp.exe

.exe 16.1MB
cracked/readme.txt

111B
cracked/version.txt

5B

cracked.zip

SHA256 cf4af9742230d2e28f40812f6fc29aecdd7721080c936c7e027e203efee8fcdc
MD5 74f62ec84d8392d0f16f705b987702b3
SHA1 036cfc4d922a95990262e071a5efd984eef1b3f2
SHA512 2f7df77f353f9d03cec42d3da30097a7be377928048ff6ca6403cc21770a58f3f5f1dc46c1d77b89bc52d027e4eaaa072c25fb3411a582fe3f7ec0397c900225
SSDEEP 393216:IZqVOsLf68YNBgT2DxHZ9nPKGMgqrxK6TGJAP24NPjeBjkJiR4uMqQ:IcMWAg67L2RTo6B6BbR4uMqQ
TLSH
T1DA0733290A847C10ED94DB8C324860EB977590A1FD964EC9930F6A06ECCB59F673FCE5
MD5 SHA1 SHA512 SSDEEP TLSH

cracked/Loader.exe

IMPHASH b0ca1cd6ba3752f03c7516fa27fcc784
SHA256 2b61296fafa08458e1e3e3d131b20634fcebbac1be8b71374cb3c03303612638
MD5 f39ad06b7b82f0470e34d3652dd38c80
SHA1 329b712c1117727f2d8709d4b720569144784430
SHA512 a5eb7d9c5ddd44f30c4af1f0a12076c3864f000fae5614710bb908176441a183f76f791961a9add516380beb06fdf3d2b602157c0c1c107f3b1e5ab4fb25e348
SSDEEP 6144:TVePbDuA1Ie3dWmwc3KrLoCrtuXw8Taa3p1NjiU40i/QqkUSutYFrjW0DzQiROJJ:TVePbDuAT3dWmwc3KrLoCrtuXw8Ta99f
TLSH
T15354EA17E18AB07DD21896F8D395CE75C638B43D8328DDEB1BA18D6119329D36FB1A03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

265936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Puffi\OneDrive\Desktop\Releasee\Injector.pdb

kernel32

OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle CreateThread VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory GetCurrentProcessId IsWow64Process GetCommandLineW Sleep VirtualFreeEx Process32First K32EnumProcessModulesEx GetModuleHandleA K32GetModuleBaseNameA HeapFree VirtualFree VirtualAlloc MultiByteToWideChar HeapAlloc GetProcessHeap GetCurrentProcess DuplicateHandle VirtualQueryEx Thread32Next Thread32First SuspendThread ResumeThread VirtualQuery OpenThread GetCurrentDirectoryW WaitForMultipleObjects Process32Next WriteProcessMemory FindClose FindFirstFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead

advapi32

GetTokenInformation OpenProcessToken

shell32

CommandLineToArgvW

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Random_device@std@@YAIXZ _Query_perf_counter

ntdll

NtQueryInformationProcess NtQueryObject NtUnmapViewOfSection

bcrypt

BCryptDestroyHash BCryptGetProperty BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memmove memcpy _CxxThrowException __std_exception_copy __std_exception_destroy __C_specific_handler __current_exception_context memcmp __current_exception

api-ms-win-crt-runtime-l1-1-0

_errno _initterm _get_narrow_winmain_command_line _c_exit _initterm_e _exit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe abort _register_thread_local_exe_atexit_callback _cexit exit _crt_atexit _register_onexit_function _beginthreadex

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-string-l1-1-0

toupper _stricmp wcscpy_s strncmp strlen strcmp wcslen

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc fgetc fclose fwrite fsetpos fputc fread _fseeki64 _get_stream_buffer_pointers fflush __p__commode _set_fmode fgetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf

cracked/Madium-Module.dll

IMPHASH 03f9cd24f73c6a51719b20ab60ed467b
SHA256 074dd48a356a8f78475cf594a3ff3ea211e42441c19f8a0286d20d7275ac3c4b
MD5 2cfbfe0a0ceae7880b66878992b0b59f
SHA1 fc4d3015aa4470a26c29efe207ce93688e148736
SHA512 789df3c3d520bbd648a14ef5b777be1efac734becd2fc06060ca6a33de713d2fdaf4bfd80520e0bfb1557ce7552902f558609b3cc9f8b73b3ac1e98822808824
SSDEEP 49152:E41Do7oHGjKE5MZPd0KOyTWn7lDdjoUTuZtK61xPXb0O/4nqx/PfQMwai5FKRQMo:3oAdqK3r+51AH6K/aOrimuEmCLTqtyY
TLSH
T1C4869D56B7A400ACD47BD13CCAA78613E7B2B8552731ABCF16A456B91F23BE0173E350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4581728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ntdll

RtlCaptureContext RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlVirtualUnwind VerSetConditionMask RtlUnwind

bcrypt

BCryptGenRandom

advapi32

CryptDecrypt CryptHashData CryptGetHashParam CryptAcquireContextA RegOpenKeyExA RegQueryValueExA RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptEnumProvidersW CryptCreateHash CryptDestroyHash CryptSignHashW

kernel32

CreateFileA LoadLibraryA FreeLibrary FlushInstructionCache OpenEventA WaitForSingleObject ReleaseMutex OpenMutexA SetEvent UnmapViewOfFile OpenFileMappingA MapViewOfFile QueryPerformanceFrequency MultiByteToWideChar GlobalFree WideCharToMultiByte GetLocaleInfoA IsDBCSLeadByte GetProcAddress InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLocalTime GetCurrentProcessId TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount FormatMessageA GetHandleInformation GetLastError SetLastError CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce GetTickCount64 GetModuleHandleW SetFileCompletionNotificationModes VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetSystemDirectoryA ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW GetACP GetStdHandle GetFileType ConvertFiberToThread ConvertThreadToFiberEx GlobalAlloc SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionEx CompareFileTime FormatMessageW MoveFileExA WaitForSingleObjectEx GetVolumeInformationA VerifyVersionInfoW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetEndOfFile SetStdHandle DeleteFileW HeapReAlloc FlushFileBuffers GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW GetConsoleOutputCP SetFilePointerEx IsProcessorFeaturePresent FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW GetTimeZoneInformation SetConsoleCtrlHandler ExitProcess ReadFile FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer RaiseException GetSystemTimePreciseAsFileTime CloseHandle GetEnvironmentVariableA GetFileInformationByHandleEx MoveFileExW HeapSize WriteConsoleW AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetCurrentThreadId VirtualAlloc GlobalUnlock SleepEx GlobalLock CreateFileW TerminateProcess GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetModuleHandleExW WriteFile GetCurrentProcess QueryPerformanceCounter GetSystemTimeAsFileTime Sleep GetModuleHandleA SetEnvironmentVariableW GetProcessHeap GetConsoleMode GetLocaleInfoEx LocalFree WakeConditionVariable SleepConditionVariableSRW WakeAllConditionVariable

user32

GetClientRect mouse_event GetForegroundWindow MapVirtualKeyA ClientToScreen GetSystemMetrics keybd_event SetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetWindowLongPtrA CallWindowProcA GetClipboardData GetCursorPos ReleaseDC SetCursorPos IsIconic SetForegroundWindow ReleaseCapture IsWindowUnicode SetWindowLongW SetCursor SetCapture BringWindowToTop SetFocus MessageBoxA GetPropA GetMonitorInfoA GetKeyboardLayout TrackMouseEvent IsChild SetWindowLongA GetCapture ShowWindow WindowFromPoint RegisterClassExW ScreenToClient CreateWindowExW EnumDisplayMonitors MonitorFromWindow SetWindowPos GetDC DestroyWindow LoadCursorA SetPropA GetMessageExtraInfo GetKeyState AdjustWindowRectEx DefWindowProcW GetWindowLongW GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetWindowThreadProcessId GetWindowTextA EnumWindows SetLayeredWindowAttributes

gdi32

GetDeviceCaps

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

crypt32

CertGetIntendedKeyUsage CertOpenSystemStoreA CertGetEnhancedKeyUsage CertGetCertificateContextProperty CertOpenSystemStoreW CertOpenStore CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore

ws2_32

WSAResetEvent getsockopt WSAGetLastError accept connect recv recvfrom sendto htonl htons ntohs select WSAStartup WSACleanup getaddrinfo freeaddrinfo inet_pton bind closesocket getsockname listen send setsockopt socket ioctlsocket inet_ntop WSAIoctl WSASocketA WSASetLastError inet_addr inet_ntoa __WSAFDIsSet WSAWaitForMultipleEvents getpeername WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent shutdown getservbyname getservbyport gethostbyname gethostbyaddr

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

903KB

Virtual Size

923KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

cracked/Madium.authspoof.exe

IMPHASH 490f69c764a463a231365af5d0be1cce
SHA256 c2bd8149ab84f1faa5d91898c2be384b0c61130580acff8b2e30845fbcaa99a1
MD5 9e02992b6274ac18168b021794720267
SHA1 02e5a5e24219470aa650dad9915579e3dca864d9
SHA512 84fbc4b6bc0b313072aaf82ceac9f20e7c45e7b0b54289921af6916f504096e13f5b8de908dca25d7f0e711ff7378a03aa97b422dd09cbfd874a90004c91dd7d
SSDEEP 196608:/V7/9hXNfqln+/Bwar7BpPH3hjL7HfD0DUWw:lF9NfqN+/VBpvl7HfDEUW
TLSH
T1CBC6AF07F684C1F4C4AEC278836B9636EA32B8894524729F1BE45B112F2BF606F1D75D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4904464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Madium.pdb

kernel32

ExitProcess TerminateProcess GetSystemDirectoryW ReleaseSemaphore DuplicateHandle WaitForMultipleObjects GetSystemTimes GetProcessIoCounters GetProcessTimes ReadProcessMemory WaitForSingleObjectEx LocalFree VirtualQueryEx OpenProcess GlobalMemoryStatusEx LoadLibraryW GetSystemInfo WakeAllConditionVariable GetUserDefaultUILanguage RtlPcToFileHeader GetSystemTimePreciseAsFileTime SleepEx SetHandleInformation GetModuleFileNameW LoadLibraryA GetSystemTimeAsFileTime MultiByteToWideChar LCIDToLocaleName RaiseException FlsAlloc FlsGetValue SwitchToThread lstrlenW FlsSetValue FlsFree HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetModuleHandleA Sleep GetProcAddress EncodePointer WideCharToMultiByte GetCurrentProcessId CompareStringOrdinal LoadLibraryExA FormatMessageW RegisterWaitForSingleObject GetLastError CloseHandle HeapAlloc FindNextFileW GetFileAttributesW CreateProcessW CreateEventW CreateWaitableTimerExW GetCurrentProcess ReadFileEx WriteFileEx CreateThread DeviceIoControl MoveFileExW CopyFileExW GetFinalPathNameByHandleW DeleteFileW GetTempPathW SetFilePointerEx SetFileInformationByHandle SetFileTime RtlLookupFunctionEntry FindFirstFileExW CreateDirectoryW WriteConsoleW SleepConditionVariableSRW UnregisterWaitEx GetConsoleOutputCP FreeLibrary GetConsoleMode GetStdHandle GetExitCodeProcess InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue OutputDebugStringA OutputDebugStringW LoadLibraryExW GetProcessId ReleaseMutex SetEvent HeapFree WaitForSingleObject UnmapViewOfFile SetWaitableTimer SetLastError MapViewOfFile OpenFileMappingA GetModuleHandleW GetCurrentThreadId GetVolumeInformationW CreateMutexA CreateEventA GetWindowsDirectoryW CreatePipe GetFullPathNameW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CancelIo ReadDirectoryChangesW RemoveDirectoryW GetOverlappedResult WriteFile PostQueuedCompletionStatus ReadFile CreateSemaphoreW GetQueuedCompletionStatusEx CreateFileW CancelIoEx CreateIoCompletionPort SetFileCompletionNotificationModes GetProcessHeap QueryPerformanceFrequency SetEnvironmentVariableW InitializeCriticalSectionEx GetEnvironmentVariableW QueryPerformanceCounter GetCurrentDirectoryW CreateFileMappingA GetCommandLineW SetUnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW InitializeSListHead K32GetPerformanceInfo DeleteCriticalSection AddVectoredExceptionHandler

advapi32

CopySid GetLengthSid RegGetValueW RegCloseKey RegOpenKeyExW IsValidSid OpenProcessToken RegQueryValueExW GetTokenInformation EventWriteTransfer EventSetInformation EventRegister EventUnregister

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile RtlCaptureContext RtlVirtualUnwind NtOpenFile NtCreateNamedPipeFile NtQueryInformationProcess RtlGetVersion RtlUnwindEx NtWriteFile NtReadFile NtQuerySystemInformation RtlNtStatusToDosError

shell32

CommandLineToArgvW ILCreateFromPathW DragFinish SHAppBarMessage ShellExecuteExW SHCreateItemFromParsingName ILFree ShellExecuteW SHOpenFolderAndSelectItems SHGetKnownFolderPath DragQueryFileW

ole32

CoInitialize RevokeDragDrop CoCreateInstance CoUninitialize CoInitializeEx OleInitialize CoTaskMemFree RegisterDragDrop CoTaskMemAlloc CoCreateFreeThreadedMarshaler

user32

SetParent SetPropW RegisterClassExW CreateWindowExW GetKeyboardState FlashWindowEx GetAsyncKeyState SystemParametersInfoW TrackMouseEvent SetWindowPos EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity MonitorFromRect ToUnicodeEx GetKeyState MapVirtualKeyExW GetKeyboardLayout ShowCursor ClipCursor GetSystemMetrics GetClipCursor GetWindowLongPtrW SetWindowLongW GetSystemMenu GetWindowPlacement GetMonitorInfoW GetMessageA ScreenToClient RedrawWindow AdjustWindowRect EnableWindow GetWindowTextW GetTouchInputInfo CloseTouchInputHandle FindWindowExW SetWindowRgn GetParent SetWindowTextW GetWindow TranslateMessage IsWindowEnabled SetFocus GetForegroundWindow SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture SetCapture InvalidateRect DestroyWindow RegisterWindowMessageA UpdateWindow DispatchMessageA PostMessageW SetCursorPos IsWindow RegisterTouchWindow IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu EnumChildWindows LoadCursorW IsIconic SetCursor GetWindowTextLengthW IsWindowVisible GetWindowThreadProcessId EnumWindows TranslateAcceleratorW MsgWaitForMultipleObjectsEx MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData SetWindowLongPtrW GetMenuItemInfoW DispatchMessageW GetMessageW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

comctl32

SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass DefSubclassProc

shlwapi

SHCreateMemStream

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

gdi32

BitBlt CombineRgn CreateRectRgn DeleteObject CreateSolidBrush SetBkMode SetTextColor CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDeviceCaps

ws2_32

WSAStartup WSACleanup setsockopt closesocket accept getsockname WSASend shutdown send recv freeaddrinfo getsockopt getaddrinfo connect WSASocketW getpeername WSAGetLastError socket ioctlsocket bind listen WSAIoctl

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

crypt32

CertOpenStore CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertSetCertificateContextProperty CertGetCertificateChain CertCloseStore CertCreateCertificateChainEngine CertFreeCertificateContext CertFreeCertificateChainEngine

pdh

PdhCollectQueryData PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue PdhOpenQueryA

rstrtmgr

RmRegisterResources RmGetList RmStartSession RmEndSession

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

api-ms-win-crt-string-l1-1-0

strcmp strlen wcslen strcpy_s wcscmp _wcsicmp

api-ms-win-crt-math-l1-1-0

roundf pow round floor trunc __setusermatherr

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _wassert _seh_filter_exe _initialize_onexit_table _initialize_narrow_environment _get_initial_narrow_environment _errno _initterm _initterm_e abort _set_app_type exit _exit _register_onexit_function __p___argc _register_thread_local_exe_atexit_callback _c_exit _cexit _configure_narrow_argv __p___argv

api-ms-win-crt-convert-l1-1-0

strtol _wtoi wcstol _ultow_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

feof _set_fmode fopen __p__commode __acrt_iob_func fflush __stdio_common_vfprintf _fileno __stdio_common_vsprintf __stdio_common_vsscanf fread fclose fgets ferror fseek _setmode fwrite ftell

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc calloc realloc

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

cracked/RUNTHIS.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0f9de1348ae8631769a4a59ed17aba91e83fdc251af35b8334f5982bdec57e3f
MD5 052315b2b90d36ea7c81149caee90541
SHA1 740333b21d6af28653cfe8e6449d48594b7f00a5
SHA512 fcfd81033ef65061ada88a1618a1c24099a0d2a50fd907189badd70cc7d9bb56f857873ad8c7292098b4333deadb2a1d3cd599c6790549b058f4fdb740610911
SSDEEP 96:3GZjaEEISl7Wwlg2xNlEJ5YAyW0PGhGaa5iS+NbzNt:IjaJISNlJxNlQ5YAd0PGhGzMDN9
TLSH
T1F9D1FA119BF84712E1FF8B7C1EB303202772F623953A878F68C8629A6D127940675BF1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cracked/lsp/luau-lsp.exe

IMPHASH 3f8598ffe56eda61b40e2aa98e11b949
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

110416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\luau-lsp\luau-lsp\build\RelWithDebInfo\luau-lsp.pdb

dbghelp

StackWalk64 SymInitialize SymGetOptions SymSetOptions SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSendRequest WinHttpSetCredentials WinHttpQueryHeaders WinHttpOpenRequest

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA RegSetKeyValueW SystemFunction036

kernel32

GetOEMCP GetACP IsValidCodePage FlushFileBuffers HeapQueryInformation HeapSize GetCurrentDirectoryW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetCurrentDirectoryW GetNamedPipeInfo GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileAttributesW LocalFree MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent VirtualProtect GetCurrentThreadStackLimits InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce CreateDirectoryW DeleteFileW RemoveDirectoryW GetLastError GetModuleFileNameW GetCurrentProcess TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 CloseHandle GetCurrentProcessId VirtualQuery FreeLibrary LoadLibraryExW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCurrentThread GetThreadId GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadLibraryA RaiseException DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetModuleHandleA GetModuleFileNameA RtlCaptureStackBackTrace CreateFileW LockFileEx SetEndOfFile UnlockFileEx CreateProcessW GetStdHandle GetFileType SetUnhandledExceptionFilter AddVectoredExceptionHandler SetEvent SleepEx CreateEventW Sleep GetCurrentThreadId GetExitCodeThread FlushInstructionCache OpenProcess GetVersion VirtualAllocEx VirtualProtectEx WriteProcessMemory WerRegisterRuntimeExceptionModule RemoveVectoredExceptionHandler GetFileSizeEx ReadFile SetFilePointerEx WriteFile RtlUnwind FindFirstFileExW GetFileTime MoveFileExW LoadLibraryW FormatMessageA DuplicateHandle GetSystemInfo VirtualQueryEx ReadProcessMemory SetLastError SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime FormatMessageW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection IsValidLocale GetLocaleInfoW LCMapStringW VirtualAlloc VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable WaitForSingleObjectEx SwitchToThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetSystemTimePreciseAsFileTime InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW GetStartupInfoW InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetDriveTypeW GetFullPathNameW IsProcessorFeaturePresent GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetCommandLineA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapAlloc HeapFree GetTempPathW IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW

shell32

CommandLineToArgvW

Name

.text

Size

13.5MB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

622KB

Virtual Size

621KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cracked.zip

cracked/Loader.exe

kernel32

advapi32

shell32

msvcp140

ntdll

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic

cracked/Madium-Module.dll

ntdll

bcrypt

advapi32

kernel32

user32

gdi32

shell32

ole32

imm32

d3dcompiler_47

api-ms-win-core-synch-l1-2-0

crypt32

ws2_32

generic

cracked/Madium.authspoof.exe

kernel32

advapi32

oleaut32

bcryptprimitives

ntdll

shell32

ole32

user32

api-ms-win-core-synch-l1-2-0

comctl32

shlwapi

dwmapi

gdi32

ws2_32

version

crypt32

pdh

rstrtmgr

psapi

powrprof

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

cracked/RUNTHIS.exe

mscoree

dotnet

cracked/lsp/luau-lsp.exe

dbghelp

version

winhttp

advapi32

kernel32

shell32