crypted[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
crypted.exe
Size 11.1MB
Sample260814-ahn4ea1ekc
SHA256 ffbfda2b701f97bc5124e626234c848564185f6133ffaf007d87b94b99360c62
MD5 4914c844e5d94672827bb63f7c4fd19e
SHA1 5f0c52881f0e6dc9789c5c7a563b348428074428
SHA512 9b4c937315cb1c02b6fb5529f1fba5d99faf2de969fb404069992574bbe0e061dfe69efcfb7085dc7dcbf83f921a97e2e26b7d771f0df14f4095348876915aeb
SSDEEP 24576:m3cszoA9pP1y27ZXYCRkJmVq2PLiNdssBq0vL4KZceRVlQ:m3cszdnYCwmsaiNdsaj4KZcey
TLSH
T1B1C66A17AFDC13FCE627C3FC8A959232E2F174410761AADB1655D7193E23AE06E3A211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crypted.exe

File Explorer

crypted.exe

.exe 11.1MB

crypted.exe

IMPHASH 18fc03e2f2db32b2dacf04f213d1fab5
SHA256 ffbfda2b701f97bc5124e626234c848564185f6133ffaf007d87b94b99360c62
MD5 4914c844e5d94672827bb63f7c4fd19e
SHA1 5f0c52881f0e6dc9789c5c7a563b348428074428
SHA512 9b4c937315cb1c02b6fb5529f1fba5d99faf2de969fb404069992574bbe0e061dfe69efcfb7085dc7dcbf83f921a97e2e26b7d771f0df14f4095348876915aeb
SSDEEP 24576:m3cszoA9pP1y27ZXYCRkJmVq2PLiNdssBq0vL4KZceRVlQ:m3cszdnYCwmsaiNdsaj4KZcey
TLSH
T1B1C66A17AFDC13FCE627C3FC8A959232E2F174410761AADB1655D7193E23AE06E3A211
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

608656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CompareStringEx CompareStringOrdinal CreateEventExW DuplicateHandle FindNLSStringEx FindStringOrdinal FormatMessageW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetLocaleInfoEx GetModuleFileNameW GetStdHandle GetThreadPriority LCMapStringEx LoadLibraryExW LocalFree LocaleNameToLCID MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ResolveLocaleName SetEvent SetLastError SetThreadErrorMode Sleep SleepEx VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetModuleHandleW GetProcAddress RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent GetSystemTimeAsFileTime FlushProcessWriteBuffers InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoInitializeEx CoGetApartmentType CoUninitialize CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-string-l1-1-0

_stricmp strcpy strlen strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table abort _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv terminate __p___argc _exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale