Rhinoceros.v8.3.24009.15001.Keymaker-CORE.rar
- SHA256 d4d7be5087b751802ae006b5bda3ddb6700b35e4d8a9486d6f1537a6fbca770c
Static task
static1
2 signatures
General
- Target Rhinoceros.v8.3.24009.15001.Keymaker-CORE.rar
- Size 384KB
- Sample260909-cd2vtaap5z
- SHA256 d4d7be5087b751802ae006b5bda3ddb6700b35e4d8a9486d6f1537a6fbca770c
- MD5 b6cc00ab951909462e09c357f3b6e123
- SHA1 b51435dfbe43a140fdb3971d0dbcddda90d3d74a
- SHA512 45ec83e6b0eae3b44abe450bca8aa61c54102c1ba5c310e90e06a0102c83cbc483c22bc24c34776fd3ce5eb063892b5fd7bc85f0dbe79eba4545e755187cd78f
- SSDEEP 12288:SLO+yKMi8uBrHfpbrWrC5Mm7IpS7YVJib49aMW:S/y+HRbrMGHIpOYDib4U3
- TLSH T151842379A1C18FB30A41452C71491218CE5B7E6AAF8DBCD0E643EE6D6030EE455FD8FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/cr-keygen.exe ConfuserEx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cr-keygen.exe
File Explorer
-
Rhinoceros.v8.3.24009.15001.Keymaker-CORE.rar.rar 384KB
-
CRACKSurl.txt1KB
-
Join Telegram for more.url.url 128B
-
core.nfo11KB
-
core.ru.do2KB
-
cr-keygen.exe.exe 486KB
-
file_id.diz362B
CRACKSurl.txt
- SHA256 b11ab0a1e6db7bb9b7da6a92aaaabf48627deff6cd5f6320da3709490151ef8d
- MD5 90e4d146072a719c280f387b2ed4493e
- SHA1 68ab0bf2670e2d027f82f153e8e7d0b7ae5fa983
- SHA512 98ddb1c9b02db257daa15165187b309f93874498985f1aea3ed988e22e5110018d766eeca636bf1554a2a74a50c81a0e9186ece04a2cb8d4f80eefae97fcc457
- TLSH T19C31E502BEDC2D127D207E861A3DE0E106AA12C140394FD26B79358486CFFB97F97B51
- MD5 SHA1 SHA512 TLSH
Join Telegram for more.url
- SHA256 771846ab3f8c33f137024e6a13e5a41ac30a212a8076ca80d8cb96093a77da69
- MD5 8e69ef0723269ec6a3f88b38f3d87cb6
- SHA1 98e410c6fca03ab37d2e82bc103f499019d8d5b4
- SHA512 63d3e6f00d44a243119624a09a4e3261fc114775a6fbf4d561e849905383a391dceb558f8606cad4f03682b78119c8b26e5c23141f22420aeb15b7e9f4e231d1
- TLSH T1B9B092AF4246828BD352D50A60B0F908985EBAB498E6D05C6648EEDA0C980D2C658A36
- MD5 SHA1 SHA512 TLSH
core.nfo
- SHA256 9d1e87fc76c0fcb8241abfd1b854f95921ecd0fc2b40cc9b5efbae2d3e1566ba
- MD5 2cdacdb55f9c22846695ff225a231536
- SHA1 ecf3fa996daa2fdec8b30311b36e106bc63360e7
- SHA512 389cc6603b21d3b7aafe843b9e2b847deb4d0235f9fe9ac1c387eeb7eaab4ede7c6b74db6486e198aaf652c8e87983bca27193c80ed61b0eb5f5c87b9204000a
- SSDEEP 96:dn4RcuF7sQq0envwH4fOmuL1I7LTxa18GP2rFDZICP1P34PrPuoRLnj9bK:dn46uxsloH0jSidq8GerUCP1y5JVK
- TLSH T14742650787A8FAFE4F72629414D51380F6D7758F233919B0701E107A7BA72B642FDA62
- MD5 SHA1 SHA512 SSDEEP TLSH
core.ru.do
- SHA256 434fcc192592c35d438ea9d7a7ed01cea6fa172d8f65489ed4dcb62b7344e98f
- MD5 a610698224bf8cbe9d180a70a2669ee6
- SHA1 00b1dfcf6118c3a6e2a703484e41f191f6efd43c
- SHA512 49fc9f1b90bcafb37cd0528e0d94a66eb830d9386c8b9fe7b72ba19c06e735f5550bffa21d09a829e78b61a296cbc5cf129bc64dcdb3d2180bcb591bdd0511b0
- TLSH T187517303A78873390FF302AB390D11D6EE661EAD371940A07968406C2B7926563BA2D9
- MD5 SHA1 SHA512 TLSH
cr-keygen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1f02437b3b6fcac0777cd20cecfafdcf169157aa2a6098a99de7c54b1a33d296
- MD5 a2d2ce589f45f848dd86f3bf2e335bbf
- SHA1 d5c74bdc11c358945b3765230244e78c78051509
- SHA512 b3d9003f4d9cefd21e5563b26326477ecf76c7f3cc0e43b75ee5bd84012660c038e26cf21a160f756a1ce1077f90b516036b37d40e9b1013e4d8a25246b36553
- SSDEEP 12288:Re2G0n5bs6mh7PRWNra7O/6J5n+4ykKbyog:Re2GObs6mhUl0n+4
- TLSH T10DB4DF4DB79475DFCADAC676D9950CA0ABB07876230B934360631AFC9F1E293DE040A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
387703
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.core0
Size
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.core1
Size
481KB
Virtual Size
480KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
file_id.diz
- SHA256 bc041619e419d9534de97fc2c92d1ad81eec4e6bdd8f744f85d84107c8893a09
- MD5 7174893def2b97647e53db38d8b94c09
- SHA1 30e9aefa66f60409450f9f1caada180e67859f75
- SHA512 a2edd71f1e34fac5dbf13d74b2417e1bdb3d4e9f363b79e59813c3520837672b5ec3499f828cff0ed73adbcc7c73520242a2b831296f1ce0c17990f75d31ea76
- TLSH T195E017165C12E1061A49F8F05E4FFB2F82022AE3C317696AB36C0278DB097C6696F0C7
- MD5 SHA1 SHA512 TLSH