crp[.]exe | Triage™

Resubmissions

21/08/2026, 02:40

260821-c56m3s1elf

21/08/2026, 02:37

260821-c38pna1drd7

Sharing

Copy URL Twitter E-mail

General

Target
crp.exe
Size 5.8MB
Sample260821-c56m3s1elf
SHA256 e069ae9db2ddfa5eac643962b02c3a81c163f4bf46e2a9888520f0cebf5e3a37
MD5 082f864f9d77807b2de99583ca7332dd
SHA1 631668b574cd6b3a5fb62c0d2dfa40a9e30609be
SHA512 a46a901aa1c941c06dc16234c894d051986f15e39e0ba5a4a9d7201aed81498fc8b7730c00121cefb916a197dd35fe79beb5fdf223fcfef1bf324046f055e8ff
SSDEEP 49152:n0iEPoOCAqwy12sM05j9XQ2thQy/Z0ymc4ggu6a0WaBUFqxPvMNsg6/bHLDM/DHo:17x7xxtx0JFxUscR5vmEqkbeOohgOQ6
TLSH
T1AF564B55BA6B94ACD197C47483468A639E2130DF0B36BAFF418485383F6ABF11B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crp.exe

File Explorer

crp.exe

.exe 5.8MB

crp.exe

IMPHASH 736029744d6e019a39ea152cdcd00c12
SHA256 e069ae9db2ddfa5eac643962b02c3a81c163f4bf46e2a9888520f0cebf5e3a37
MD5 082f864f9d77807b2de99583ca7332dd
SHA1 631668b574cd6b3a5fb62c0d2dfa40a9e30609be
SHA512 a46a901aa1c941c06dc16234c894d051986f15e39e0ba5a4a9d7201aed81498fc8b7730c00121cefb916a197dd35fe79beb5fdf223fcfef1bf324046f055e8ff
SSDEEP 49152:n0iEPoOCAqwy12sM05j9XQ2thQy/Z0ymc4ggu6a0WaBUFqxPvMNsg6/bHLDM/DHo:17x7xxtx0JFxUscR5vmEqkbeOohgOQ6
TLSH
T1AF564B55BA6B94ACD197C47483468A639E2130DF0B36BAFF418485383F6ABF11B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4666908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

IT_solutions.pdb

crypt32

CertFreeCertificateContext CertCloseStore CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertEnumCertificatesInStore CertDuplicateStore CertAddCertificateContextToStore CertGetCertificateChain CertVerifyCertificateChainPolicy CryptUnprotectData CryptProtectData CryptStringToBinaryA CertCreateCertificateContext CertOpenStore

kernel32

GetUserDefaultGeoName GetLocaleInfoEx CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentThreadId WaitForSingleObject HeapReAlloc CreateThread QueryPerformanceFrequency QueryPerformanceCounter GetSystemInfo GetProcessId GetExitCodeProcess LocalFree OpenProcess GetProcessTimes QueryFullProcessImageNameW TerminateProcess CreateJobObjectW SetInformationJobObject ProcessIdToSessionId FlushFileBuffers MoveFileExW CreateMutexW AssignProcessToJobObject CreatePipe SetHandleInformation CreatePseudoConsole InitializeProcThreadAttributeList UpdateProcThreadAttribute ClosePseudoConsole DeleteProcThreadAttributeList CreateProcessW ResumeThread ResizePseudoConsole WriteFile FindFirstFileExW FindNextFileW GlobalSize GlobalLock GlobalUnlock GlobalAlloc GlobalFree CompareStringOrdinal GetTimeZoneInformationForYear AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetSystemTimePreciseAsFileTime GetQueuedCompletionStatusEx GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW CancelIoEx CreateFileW GetModuleHandleW ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW WriteFileEx SleepEx ReadFileEx FormatMessageW GetModuleHandleA GetFullPathNameW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW CancelIo GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetCommandLineW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException OutputDebugStringA OutputDebugStringW FormatMessageA GetCurrentProcessId GetProcAddress GetLastError GetProcessHeap HeapFree CloseHandle FindClose SwitchToThread TerminateJobObject PostQueuedCompletionStatus GetTempPathW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile SetFilePointer CreateFileA GetFullPathNameA LoadLibraryW HeapCompact UnlockFileEx LockFile UnlockFile LockFileEx GetFileSize GetDiskFreeSpaceW FreeLibrary GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile GetTickCount HeapCreate AreFileApisANSI SystemTimeToFileTime HeapDestroy SetEndOfFile DeleteFileA

user32

SetKeyboardState OpenClipboard GetSystemMetrics CreateDesktopW PeekMessageW ChildWindowFromPointEx IsClipboardFormatAvailable GetClipboardData CloseClipboard EmptyClipboard SetClipboardData OpenInputDesktop GetThreadDesktop MapVirtualKeyW SendInput ReleaseDC GetDC GetClipboardSequenceNumber ScreenToClient PostMessageW SetFocus SetActiveWindow BringWindowToTop GetKeyboardState SetThreadDesktop GetGUIThreadInfo CloseDesktop GetClassNameW IsWindow AttachThreadInput IsWindowVisible GetWindowRect EnumDesktopWindows PrintWindow GetWindowThreadProcessId GetAncestor SendMessageTimeoutW

gdi32

StretchBlt SetStretchBltMode DeleteDC DeleteObject SelectObject CreateDIBSection CreateCompatibleDC

iphlpapi

NotifyIpInterfaceChange

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

secur32

ApplyControlToken AcceptSecurityContext AcquireCredentialsHandleA InitializeSecurityContextW QueryContextAttributesW FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle DecryptMessage EncryptMessage

ws2_32

WSASend send getsockopt freeaddrinfo getaddrinfo connect ioctlsocket WSASocketW setsockopt WSACleanup WSAGetLastError getpeername getsockname WSAIoctl shutdown closesocket recv bind WSAStartup

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile

vcruntime140

__CxxFrameHandler3 strrchr memcmp __current_exception_context __current_exception memchr __C_specific_handler memmove strchr _CxxThrowException memset memcpy

api-ms-win-crt-math-l1-1-0

round pow __setusermatherr log

api-ms-win-crt-string-l1-1-0

strcspn strlen strncmp strcmp strspn

api-ms-win-crt-heap-l1-1-0

free malloc _msize _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _endthreadex _register_onexit_function terminate _crt_atexit _seh_filter_exe _get_initial_narrow_environment _set_app_type _initterm_e exit _exit _initialize_onexit_table __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initterm _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale