cbeta catpws new[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cbeta catpws new.zip
Size 1.3MB
Sample260909-3g2mbstyat
SHA256 1abd83dfa277d721b0e99afe5e3a13a21e6eddeb2186a322e5c31907a9d5c2a1
MD5 49f0125092e7cf540006cfbdfbe623c4
SHA1 bd3259cf576350eb5d4c04b6ecc4bcaec1c661cd
SHA512 b9a2cf36fe63e78f1f62ea8df6c1fcf8c4de5fe0a22b691bdd65467054a0c0c8ccb024e66cde20d205d27f76c471673d5e8f4328157a2f4df76af3bbc6efcb03
SSDEEP 24576:q7vgSNGbGEpW6KhmtqTUamztq5ZzQhfkZ3SQaVUi9QbWyJR6V7T1gD:gvgSNaVE7F+yZyfu3Gai9QbWyJkfi
TLSH
T1AE5533C89DB8321C5DDF35A37D84C7D155E88831E29E9F9C75B2253240E2AE39E93983
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cbeta catpws new/RobloxCrashHandler.exe

File Explorer

cbeta catpws new.zip

.zip 1.3MB
cbeta catpws new/RobloxCrashHandler.exe

.exe 2.5MB

cbeta catpws new.zip

SHA256 1abd83dfa277d721b0e99afe5e3a13a21e6eddeb2186a322e5c31907a9d5c2a1
MD5 49f0125092e7cf540006cfbdfbe623c4
SHA1 bd3259cf576350eb5d4c04b6ecc4bcaec1c661cd
SHA512 b9a2cf36fe63e78f1f62ea8df6c1fcf8c4de5fe0a22b691bdd65467054a0c0c8ccb024e66cde20d205d27f76c471673d5e8f4328157a2f4df76af3bbc6efcb03
SSDEEP 24576:q7vgSNGbGEpW6KhmtqTUamztq5ZzQhfkZ3SQaVUi9QbWyJR6V7T1gD:gvgSNaVE7F+yZyfu3Gai9QbWyJkfi
TLSH
T1AE5533C89DB8321C5DDF35A37D84C7D155E88831E29E9F9C75B2253240E2AE39E93983
MD5 SHA1 SHA512 SSDEEP TLSH

cbeta catpws new/RobloxCrashHandler.exe

IMPHASH 303813cfce87a78117821c056577a714
SHA256 f964f586598828c79cf17610b3bb2448d8e86ce97d4de1c844c00c1f78620296
MD5 74ded93c397ba4257702647009a7808f
SHA1 ec20bc25c188e38e30baca588ede3360d7cdff8e
SHA512 666195a223aa598e0cb19d44d8e402d3f63ea2a4a38b276d6e00746aeb67c21b62d5fa0f09f8b189055ac53feed8db8c38126fafc5a3c0385e0e5a524f7b1651
SSDEEP 49152:umMQxY9ik8MGE20ifPt0B87h49qXcb1CSjnI8hWf6J804TMnhKDgyAVxhQY2M7en:Iik8MGE20ifPt0BuhwCSjnI8hWf6J8JU
TLSH
T173C5CF4AF3E549EDC2A6D138C546A317E77234080F3157EF2BD48A58AF837E05A7AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1172136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zanew\Desktop\pws external\sources\CURRENT\cbeta catpws\build\RobloxCrashHandler.pdb

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry VerSetConditionMask NtQueryInformationProcess RtlCaptureContext

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpSendRequest

kernel32

InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError CreateFileW Module32First GetProcessId Module32Next SetConsoleOutputCP SetConsoleCP ExitProcess GetCurrentConsoleFontEx SetCurrentConsoleFontEx ReadProcessMemory GetConsoleWindow GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CheckRemoteDebuggerPresent IsDebuggerPresent GetThreadContext RaiseException GetCurrentProcess GetFileInformationByHandleEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WakeAllConditionVariable GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetCurrentProcessId CloseHandle Process32Next CreateToolhelp32Snapshot OpenProcess TerminateProcess Process32First GetCurrentThread SetThreadPriority Sleep QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW GetFileType

user32

SetClipboardData SendInput CloseClipboard GetClipboardData GetKeyState EmptyClipboard OpenClipboard GetCursorPos ReleaseDC MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow ShowWindow IsWindow SetWindowLongA IsChild MessageBoxA SetCursorPos GetMessageExtraInfo IsWindowUnicode GetClientRect DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetSystemMetrics FindWindowExA GetWindowTextA GetAsyncKeyState FindWindowA SetCursor SetCapture GetDC GetForegroundWindow ScreenToClient ClientToScreen ReleaseCapture GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorA

gdi32

CreateCompatibleBitmap BitBlt DeleteDC CreateCompatibleDC GetDeviceCaps DeleteObject SelectObject

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

shell32

ShellExecuteW ShellExecuteA

ole32

CreateStreamOnHGlobal CLSIDFromString CoCreateInstance CoInitializeEx

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdiplusStartup GdipSaveImageToStream GdiplusShutdown GdipAlloc GdipCloneImage GdipFree

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle InternetReadFile

crypt32

CertFreeCertificateChain CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertGetCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx CertFreeCertificateChainEngine PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

ws2_32

htonl accept select WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind getaddrinfo inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket __WSAFDIsSet WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt freeaddrinfo recvfrom sendto ioctlsocket gethostname listen

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp memchr _CxxThrowException __C_specific_handler memset strstr __std_terminate __std_exception_copy __std_exception_destroy strrchr wcschr __current_exception __current_exception_context memmove strchr

api-ms-win-crt-heap-l1-1-0

calloc free malloc _callnewh _set_new_mode realloc

api-ms-win-crt-runtime-l1-1-0

_invoke_watson abort __sys_errlist _errno _beginthreadex terminate exit system __sys_nerr _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

log sqrtf _fdopen acosf sinf roundf logf powf __setusermatherr pow fmodf _fdclass nearbyint floorf ceilf cosf

api-ms-win-crt-stdio-l1-1-0

fwrite _wfopen __stdio_common_vsprintf _lseeki64 fread __stdio_common_vsscanf fputc _set_fmode fgetc setvbuf _wopen ungetc __p__commode fsetpos _read _write fgets _fseeki64 _fileno _close _get_stream_buffer_pointers fgetpos fseek __stdio_common_vsprintf_s fclose fflush __stdio_common_vfprintf feof __acrt_iob_func fputs ftell

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strncpy _stricmp strcspn tolower wcspbrk wcscpy_s strncpy_s _strdup strspn wcsncpy strpbrk strcmp strncmp wcsncmp

api-ms-win-crt-convert-l1-1-0

strtoull strtol strtoll atof atoi strtof strtoul wcstombs

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _unlink _fstat64 _lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64