shield_cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
shield_cracked.exe
Size 63.9MB
Sample260831-nrfqaattfv
SHA256 5e41edba9d7c58710e8f649426bc913d975a4b2ce6cd8cb74a7c0278b9b4bdf1
MD5 2df4e920cadb804e8d1196efac0f0f04
SHA1 8af86934336e10a643547b9a7049d7059f8f7031
SHA512 25f28978a9687f5de536532502049991457d3994761a9d0ea8406b3c3ad166c952b023f8e434a1d04b07b173deb4eb7d165cf5040efb28da7ce857752f068696
SSDEEP 786432:2btaiFrWkgdokJIMkFRkxEuLvWFMH5Vz42KYg:2btaErWk6owIMkMxEuLz
TLSH
T100E7424C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shield_cracked.exe

File Explorer

shield_cracked.exe

.exe 63.9MB

shield_cracked.exe

IMPHASH c1d51c150ca4bc8383970c0634de8e93
SHA256 5e41edba9d7c58710e8f649426bc913d975a4b2ce6cd8cb74a7c0278b9b4bdf1
MD5 2df4e920cadb804e8d1196efac0f0f04
SHA1 8af86934336e10a643547b9a7049d7059f8f7031
SHA512 25f28978a9687f5de536532502049991457d3994761a9d0ea8406b3c3ad166c952b023f8e434a1d04b07b173deb4eb7d165cf5040efb28da7ce857752f068696
SSDEEP 786432:2btaiFrWkgdokJIMkFRkxEuLvWFMH5Vz42KYg:2btaErWk6owIMkMxEuLz
TLSH
T100E7424C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67324416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess FreeLibrary GetConsoleWindow CreateProcessA CreateDirectoryA GlobalUnlock IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent GetModuleHandleW OutputDebugStringA MultiByteToWideChar WideCharToMultiByte LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter ReadFile SetLastError TerminateProcess Thread32Next Thread32First OpenProcess GetCurrentThread Module32FirstW GetThreadContext GetFileSize GetCurrentProcessId Module32NextW GetLastError GetTickCount64 GetTempPathA Sleep CreateToolhelp32Snapshot SetFileAttributesW GetModuleHandleA SetEndOfFile WriteConsoleW CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileAttributesW LCMapStringW CompareStringW LoadLibraryExW GetFileAttributesExW GlobalLock GetExitCodeProcess GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleFileNameW GetModuleHandleExW UnhandledExceptionFilter RtlVirtualUnwind GetProcAddress SetFileAttributesA GetWindowsDirectoryA CreateThread LoadLibraryW CloseHandle Process32FirstW DeleteFileW DeleteFileA WaitForSingleObject FindClose GetEnvironmentVariableA FindNextFileA WriteFile GetStdHandle GetCurrentProcess SetConsoleTitleA GetConsoleScreenBufferInfo VirtualProtect RtlCaptureContext IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable UnmapViewOfFile MapViewOfFile RtlUnwind CreateFileMappingA VirtualQuery VirtualFree VirtualAlloc RemoveVectoredExceptionHandler GetTickCount VirtualAllocEx SetFilePointer GetSystemDirectoryA VirtualFreeEx IsWow64Process GetSystemInfo DuplicateHandle HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetProcessHeap RaiseException AddVectoredExceptionHandler K32GetModuleInformation GetCPInfo GetStringTypeW CreateFileA GlobalSize Process32NextW CreateProcessW GetFileAttributesA GetLocaleInfoW FindFirstFileA LCMapStringEx LocalFree DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId EnterCriticalSection

user32

FindWindowW SetLayeredWindowAttributes UnregisterClassA MessageBoxA GetSystemMetrics GetDC PostMessageW GetWindowThreadProcessId GetWindowLongW ReleaseDC SetWindowLongW GetClassNameW SetWindowsHookExW PostThreadMessageW GetTopWindow GetWindow

gdi32

DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap DeleteObject BitBlt

advapi32

OpenProcessToken CopySid LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegCreateKeyExA GetUserNameA RegSetValueExA LookupAccountSidA RegOpenKeyExA GetLengthSid ConvertSidToStringSidA OpenThreadToken GetTokenInformation IsValidSid

shell32

SHGetFolderPathA

ole32

CLSIDFromString CreateStreamOnHGlobal GetHGlobalFromStream

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd VMProtectBeginMutation

wininet

InternetOpenA InternetSetOptionA InternetReadFile InternetQueryOptionA InternetOpenUrlA InternetCloseHandle

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpConnect

shlwapi

ord215

gdiplus

GdipSaveImageToStream GdipSaveImageToFile GdipCloneImage GdiplusShutdown GdiplusStartup GdipDisposeImage GdipFree GdipCreateBitmapFromHBITMAP GdipAlloc

userenv

UnloadUserProfile

ntdll

NtCreateSection NtUnmapViewOfSection NtClose RtlImageNtHeader NtMapViewOfSection

Name

.text

Size

53.3MB

Virtual Size

53.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.1MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

shield_cracked.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

vmprotectsdk64

wininet

winhttp

shlwapi

gdiplus

userenv

ntdll

generic