Crackers Tools 2.9 By yildo.zip
- SHA256 a5a4165af1209c9cd6e4b0dea8f56b8238d4160170476e8350b978a29badfcba
General
- Target Crackers Tools 2.9 By yildo.zip
- Size 693KB
- Sample260827-3hhkva1gpg
- SHA256 a5a4165af1209c9cd6e4b0dea8f56b8238d4160170476e8350b978a29badfcba
- MD5 2bd31befc8c04cff384aa6d36fb5e265
- SHA1 2c647a134865737caefb6e30b2372e8bcccafe41
- SHA512 f3a0284b947ef12ca05c8cafccdf0af933dc9affbd638f6d67c4465a1ccbba9601f90c6ca5818012b0db9aa22c91cdcc2d51d37847e2baf0712cee56f10385d8
- SSDEEP 12288:7oxltO+Xh/jHVCZ0wr4Lj9+UI+MjAdNtGB1tH7Oo+MQXsz:7oxlk+xjHMbwYU+jWNq7cMQm
- TLSH T16CE423EDE67936192FAE806F9FA880BE31B13D0AE67523D3CE907359414D20D925C39D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/Traytip.exe autoit_exe -
resource yara_rule static1/unpack001/Setup.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe unpack002/out.upx unpack001/Traytip.exe
File Explorer
-
Crackers Tools 2.9 By yildo.zip.zip 693KB
-
InstallTips.ini324B
-
Settings.ini164B
-
Setup.exe.exe 226KB
-
out.upx.exe 444KB
-
Traytip.au3366B
-
Traytip.exe.exe 922KB
InstallTips.ini
- SHA256 28c514de0ab4432adba007c2fe43f4979da37afe01f9360b04050f42574de8ab
- MD5 814cc1002e6652e28eb967e5e18f400e
- SHA1 cd80743682c5e0b95a4233f7ba3b2182e8d3714d
- SHA512 050757d562de15215205af0c302a7037a514629ea0fa0ba47b03c42e09518eaa3ea3ca98d266038caaa856728e0ae823f3f28784b27f106cea08bd6f35b6ea64
- TLSH T167E0C20737E70316A2B3A685BEF187B11732396DC4BED31C02C10A0A01F1D406122FD3
- MD5 SHA1 SHA512 TLSH
Settings.ini
- SHA256 a88a37c0f60bcf1fff2a4364783b091e389c223dd709de934caf12a1bec86520
- MD5 d8f8611ed4d4a6f5910c72eaa347f64c
- SHA1 0f36ba42b776e5d7eee8d9bd52f8324c2585d3a7
- SHA512 cdd3ff810a978edab00ddaf7e3b53b38a362add7b9cd56b5ec83e0ab3c533fe2f851dcbe5be6c10dcc7f5563172e449f0d23a586db9674c6cb92fe8e59d3a48e
- TLSH T1FAC08C7BB32304C1872812CA1BB64D08A326080AECB176191B55992BABBC82E472969C
- MD5 SHA1 SHA512 TLSH
Setup.exe
- SHA256 ee0779319de65b500856072bdf10934c2359f1a2aca087bf22207e15608d12e8
- MD5 94056c8f64467103ca128b4b34921bd6
- SHA1 998b405905c1a912c81a76c7213e031bf895a606
- SHA512 81ad8dcff00f8f5855808f3ac9796f12b4bae6b2f03afa7918ff1648da96d05610005c6711c2596913cfe25120fa523479fed3b2f2a435536a4ae68eb3065cec
- SSDEEP 6144:9PLkVO8A1X2og0tEHH45Y0KTIVaTycTVDNe4NT:+MJ1X2og0MHGKT3RRw0T
- TLSH T19234F115A3D98CBAD220863989CBCDB0894CBDB2C9422716EFD9FC6F7D25749508E31D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
581760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
193KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=105, version=2067,
count=5, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=31, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=174, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=8, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=25, version=9210,
count=21, id=93, version=2179,
count=468, id=1, productName=Unmarked objects,
count=53, id=100, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
out.upx
- SHA256 a88347400875949db62a5ebf7c025bf50afa80c57a1831b58d8f3e23a165dbf8
- MD5 09d9fd8f57d03ec586575bdec00041b6
- SHA1 50e3b5bfae36ad77422546101368a9d0d5925005
- SHA512 cb103d5f2de43d376f4dd4f45603797e5d573ce2ccb6e9f90de8ef8b4b189995dc344681d05653ba9f2b92b2ad2cadf934aeba81c98527fe91930122cf642cd8
- SSDEEP 6144:9hv4sIND/AB4jYWoyGN2Ik5AfPjFWFNAy/7+dOYG+BW:fABhABEXotkI0A8AyzKOc
- TLSH T1DCA48E277DE180B2D27221B4AF66D779637AFE300631A50B67D01CDB7723981AA35327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
310936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
349KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
38KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=105, version=2067,
count=5, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=31, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=174, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=8, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=109, productName=VS2005 build 50727, version=50727,
count=4, id=25, version=9210,
count=21, id=93, version=2179,
count=468, id=1, productName=Unmarked objects,
count=53, id=100, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Traytip.au3
- SHA256 6aed975c39339d538b41aca3fa17ac810c6910335d013f582ed6bfab33b54a75
- MD5 ef417722e2a311f7fe4f83c7493448e4
- SHA1 c96d85503b010d2e19b8801e01920ea15a9af6cb
- SHA512 750ce9a5e5de40bfbcec46be64fcd9f76ae25adbb60c07606838f9eb42db17d6ae70bf773593e780e1f0028ff3b8c1f102f350b1bb83aed63314bb812adc71c5
- TLSH T1B0E0DF233413CEFF0115AB49AEA14940130D1C8E1464B92C26F51060AF3D9B0B6E0FC8
- MD5 SHA1 SHA512 TLSH
Traytip.exe
- SHA256 6b3b137049ccfcfb673c9222a9b3f9dd0f8ff9d6e9c490a562f4432ba7093a0a
- MD5 75cb8b9c18039cc4b4f6cc8d327d9b7e
- SHA1 334631ca168e36262759eeafc5829fc4a8bed2b2
- SHA512 b0b57b1aecd5a98adb0741806871668adba43f1a1a1761f989d73868c7d703811fa9620313febfae2576f43adb8a113df0947e0f969ee237ce9d465a248ce41f
- SSDEEP 12288:saWzgMg7v3qnCiMErQohh0F4CCJ8lnyC877E31b4HHmajV2v48Aktz4hnRC:TaHMv6CorjqnyC8NHnjVulZF41RC
- TLSH T15515AF01F3D2D0F5DDA33870393BD726DB31791A6226C48F57F02EA6AE221455A3A376
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
90896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
328KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,