ophcrack-3[.]7[.]0-bin[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
ophcrack-3.7.0-bin.zip
Size 12.4MB
Sample260910-pr2hestbqg
SHA256 7f4540bcc698bce63740b35947f6a0c4d266669cc4fb5115bff6425987b63e54
MD5 ed8609993a33b9fe961aef9c65e05e7f
SHA1 d52fbfb3fa9a73aab644a3ab34434c30c9a55b87
SHA512 d281b9b72a0e11f067fc2777a7e3bb05b76a1ac1e6d157304a207335f9cf6b13cc4f965ea0773c0b479fe4dc8115d763f1a1a3e7cffbc6e6c2aff87d6b2e1f2b
SSDEEP 393216:DT2ZdOkPcYryzIcT6eLrkoBNFu8JONvE2fS:DCZdfPlrCHTlAoBNJONMv
TLSH
T1BFD633C630A4FF5CA82AF755F3FE21641606AD76B4A3F1881611F113AA91B9FE46FC40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/x64/ophcrack.exe
unpack001/x64/ophcrack_nogui.exe
unpack001/x86/ophcrack.exe
unpack001/x86/ophcrack_nogui.exe

File Explorer

ophcrack-3.7.0-bin.zip

.zip 12.4MB
x64/ophcrack.exe

.exe 12.0MB
x64/ophcrack_nogui.exe

.exe 1.9MB
x86/ophcrack.exe

.exe 13.0MB
x86/ophcrack_nogui.exe

.exe 1.5MB

ophcrack-3.7.0-bin.zip

SHA256 7f4540bcc698bce63740b35947f6a0c4d266669cc4fb5115bff6425987b63e54
MD5 ed8609993a33b9fe961aef9c65e05e7f
SHA1 d52fbfb3fa9a73aab644a3ab34434c30c9a55b87
SHA512 d281b9b72a0e11f067fc2777a7e3bb05b76a1ac1e6d157304a207335f9cf6b13cc4f965ea0773c0b479fe4dc8115d763f1a1a3e7cffbc6e6c2aff87d6b2e1f2b
SSDEEP 393216:DT2ZdOkPcYryzIcT6eLrkoBNFu8JONvE2fS:DCZdfPlrCHTlAoBNJONMv
TLSH
T1BFD633C630A4FF5CA82AF755F3FE21641606AD76B4A3F1881611F113AA91B9FE46FC40
MD5 SHA1 SHA512 SSDEEP TLSH

x64/ophcrack.exe

IMPHASH 8429d06124f77ee1f076b7d9c0a59fe3
SHA256 b51228763b68e5099aed33c6e7957dd2ecffccce3e577bccddccae73a056e81d
MD5 a3a489c64c7d2bed1d6abe95954f0918
SHA1 816b40414d0da7cea4c20b352231b85cb0433fa9
SHA512 5b335159a7de39b6c216ed8bda07ebfe4e14b38df1edf0d0f8a4c31139616fd91d293b6b557a1ca4c8b4781f74e8cd0f9a3626fa57d11452d88e62767c430dfe
SSDEEP 196608:pNZYpZVPIm0Yr6WArmpJsv6tWKFdu9Ct:wXh0Yr+mpJsv6tWKFdu9Ct
TLSH
T12DC68D67EAA310EDC1ABC43056A7F371B57178194134BE2F1654DB322F29FA05B2B329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CopySid DeregisterEventSource FreeSid GetLengthSid GetTokenInformation LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyA RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

comdlg32

GetOpenFileNameW GetSaveFileNameW PrintDlgExW

gdi32

AbortDoc BeginPath BitBlt CloseFigure CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateEllipticRgn CreateFontIndirectW CreatePalette CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject EndDoc EndPage EndPath EnumFontFamiliesExW ExtCreatePen ExtTextOutW FillPath GdiFlush GetBkMode GetCharABCWidthsFloatW GetCharABCWidthsW GetDIBits GetDeviceCaps GetFontData GetGlyphOutlineW GetNearestPaletteIndex GetObjectW GetOutlineTextMetricsW GetPaletteEntries GetRegionData GetStockObject GetTextExtentPoint32W GetTextFaceW GetTextMetricsW LineTo MoveToEx OffsetRgn PolyBezierTo PtInRegion RealizePalette ResetDCW RestoreDC SaveDC SelectClipPath SelectClipRgn SelectObject SelectPalette SetBkMode SetGraphicsMode SetPolyFillMode SetTextAlign SetTextColor SetWorldTransform StartDocW StartPage StretchBlt StrokePath

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionFontW ImmSetCompositionWindow

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlushViewOfFile FormatMessageW FreeLibrary GetCommandLineW GetCurrencyFormatW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileType GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProfileStringW GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersion GetVersionExW GetVolumeInformationA GetVolumeInformationW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsValidLanguageGroup IsValidLocale LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MoveFileW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlUnwindEx SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW

msvcrt

___lc_codepage_func __argv __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _clearfp _close _control87 _endthreadex _errno _exit _filelengthi64 _fileno _flushall _fmode _fstat64 _get_osfhandle _getdrive _gmtime64 _initterm _localtime64 _lock _lseek _lseeki64 _mktime64 _onexit _open_osfhandle _read _setmode _snwprintf _time64 _tzset _unlock _waccess _wchmod _wfopen _wgetdcwd _wgetenv _write abort acos asin atan atof bsearch calloc exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free frexp fseek fsetpos ftell fwprintf fwrite getc getenv localeconv log10 malloc perror printf putchar puts raise rand realloc remove rewind signal srand strerror strstr strtok strtol tan ungetc vfprintf wcscpy wcslen wcsrchr _tzname _write _strdup _putenv _open _fileno _close _access

ntdll

NtFsControlFile NtOpenFile RtlAddFunctionTable RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind __C_specific_handler _setjmp _stricmp _ultoa _vsnprintf _vsnwprintf atoi ceil floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit log longjmp mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncmp strncpy strtoul tolower toupper wcsstr

ole32

CoCreateGuid CoCreateInstance CoGetMalloc CoInitialize CoLockObjectExternal CoTaskMemFree CoUninitialize DoDragDrop OleFlushClipboard OleGetClipboard OleInitialize OleIsCurrentClipboard OleSetClipboard OleUninitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop StringFromGUID2

oleaut32

SysAllocStringLen VariantInit

shell32

SHGetFileInfoW ShellExecuteW

user32

AdjustWindowRectEx BeginPaint CallNextHookEx ChangeClipboardChain CharNextExA ClientToScreen ClipCursor CreateCaret CreateCursor CreateIconIndirect CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyWindow DispatchMessageW DrawIconEx EnableMenuItem EndPaint FlashWindowEx GetActiveWindow GetAsyncKeyState GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursorPos GetDC GetDesktopWindow GetDoubleClickTime GetFocus GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenu GetMessageW GetParent GetProcessWindowStation GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetUpdateRect GetUserObjectInformationW GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowRgn HideCaret InvalidateRect InvalidateRgn IsChild IsIconic IsWindowVisible IsZoomed KillTimer LoadIconW LoadImageW MapVirtualKeyW MessageBeep MessageBoxA MessageBoxW MoveWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient ScrollWindowEx SendMessageW SetCapture SetCaretBlinkTime SetCaretPos SetClipboardViewer SetCursor SetCursorPos SetDoubleClickTime SetFocus SetForegroundWindow SetMenuItemInfoW SetParent SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToAscii ToUnicode TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateWindow ValidateRgn WindowFromPoint

winmm

PlaySoundW

winspool.drv

ClosePrinter DeviceCapabilitiesW EnumFormsW EnumPrintersW GetPrinterW OpenPrinterW

ws2_32

WSAAsyncSelect

wsock32

htons

Name

.text

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

325KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

778KB

Virtual Size

777KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

x64/ophcrack_nogui.exe

IMPHASH 49dd3e94cf777dbe377bf4c003470b6e
SHA256 c7dba7b56b1cc305ae9fd0364bbd21755fcd068395e7c3a9a1895eea46ab3908
MD5 cdb666c7a3de29f83c637d578ab403d6
SHA1 23feef1cb57d920ecee37f24382826473cc116a3
SHA512 042038bac04fd101d2b0e0741f0504c94cd8d235f12f08656257db2f84bea8d28222c8203a5d349e9a9122792445899fdfc99ea12af78f4cf7d57e77cb796a89
SSDEEP 24576:lvpCRHbNbKrZ30KNy0zGxbwK6c9x3+shHl1VUFUUrZdBg8baF+k2datMJGYI2:1O5KrZ30ASL9+s9YZdB3m2dayJGYI2
TLSH
T1AC955B5BF7C1CDDFCA16823449EB4339273BF4902347EB572A4892386D5FA50AF86618
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegisterEventSourceW ReportEventW

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FlushViewOfFile GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileSize GetFileType GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVolumeInformationA GlobalMemoryStatusEx HeapAlloc HeapFree InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection MapViewOfFile MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WriteFile

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _onexit _setmode _snwprintf _time64 _unlock _wfopen _write abort calloc exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos ftell fwprintf fwrite getenv malloc perror printf putchar puts raise realloc rewind signal strerror strncmp strtok vfprintf wcscpy _strdup _open _fileno _close _access

ntdll

NtFsControlFile NtOpenFile RtlInitUnicodeString RtlNtStatusToDosError RtlVirtualUnwind __C_specific_handler _setjmp _stricmp _ultoa _vsnprintf _vsnwprintf atoi floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit longjmp mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncpy strtoul tolower toupper wcsstr

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

wsock32

htons

Name

.text

Size

374KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

469KB

Virtual Size

469KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

540KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/ophcrack.exe

IMPHASH 85eba03b2f7fbd21ece77134b99ecd35
SHA256 3f670b4767e412c194e367f1b0c65ace092d78f2e8c8311de89c8840b1fd3aa2
MD5 08bb83e5819d014dc3dfe135f156212e
SHA1 df596e54970580d122fb146d5a7d1b758fd52333
SHA512 443c4ab5820e7c076465627a1a6737c9869c054dbb4ea980b81a2c33836e557d1c52087db0771de56bf8fb6b041c0ccc1fb0f20070e3f6b2671ebd603b9b45a0
SSDEEP 393216:H3b7ffEeOT4bjU7NFL5VvcFCX6qO3wK31DCAA2ET6Jsv6tWKFdu9C:H3bLmT4/U7NFUFCqC+NdJ
TLSH
T1D6D61869EB47D1B1D46349F0790BE7FA99203E348031C81BF284EF58EBB6E926556313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

comdlg32

GetOpenFileNameW GetSaveFileNameW PrintDlgExW

gdi32

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionFontW ImmSetCompositionWindow

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlushViewOfFile FormatMessageW FreeLibrary GetCommandLineW GetCurrencyFormatW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileType GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProfileStringW GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersion GetVersionExW GetVolumeInformationA GetVolumeInformationW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsValidLanguageGroup IsValidLocale LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MoveFileW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _clearfp _close _control87 _endthreadex _errno _exit _filelengthi64 _fileno _flushall _fmode _fstati64 _get_osfhandle _getdrive _initterm _iob _lock _lseek _lseeki64 _onexit _open_osfhandle _read _setjmp3 _setmode _snwprintf time mktime localtime gmtime exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free frexp fseek fsetpos ftell fwprintf fwrite getc getenv localeconv log10 malloc perror printf putchar puts raise rand realloc remove rewind setlocale signal srand strerror strstr strtok strtol _tzset _unlock _waccess _wchmod _wfopen _wgetdcwd _wgetenv _write abort acos asin atan atof tan ungetc vfprintf wcscpy wcslen wcsrchr bsearch calloc _tzname longjmp _write _strdup _putenv _open _fileno _close _access

ntdll

NtFsControlFile NtOpenFile RtlInitUnicodeString RtlNtStatusToDosError _stricmp _ultoa _vsnprintf atoi ceil floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit log mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncmp strncpy strtoul tolower toupper wcsstr

ole32

oleaut32

SysAllocStringLen VariantInit

shell32

SHGetFileInfoW ShellExecuteW

user32

AdjustWindowRectEx BeginPaint CallNextHookEx ChangeClipboardChain CharNextExA ClientToScreen ClipCursor CreateCaret CreateCursor CreateIconIndirect CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyWindow DispatchMessageW DrawIconEx EnableMenuItem EndPaint FlashWindowEx GetActiveWindow GetAsyncKeyState GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursorPos GetDC GetDesktopWindow GetDoubleClickTime GetFocus GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenu GetMessageW GetParent GetProcessWindowStation GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetUpdateRect GetUserObjectInformationW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowRgn HideCaret InvalidateRect InvalidateRgn IsChild IsIconic IsWindowVisible IsZoomed KillTimer LoadIconW LoadImageW MapVirtualKeyW MessageBeep MessageBoxA MessageBoxW MoveWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient ScrollWindowEx SendMessageW SetCapture SetCaretBlinkTime SetCaretPos SetClipboardViewer SetCursor SetCursorPos SetDoubleClickTime SetFocus SetForegroundWindow SetMenuItemInfoW SetParent SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToAscii ToUnicode TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateWindow ValidateRgn WindowFromPoint

winmm

PlaySoundW

winspool.drv

ClosePrinter DeviceCapabilitiesW EnumFormsW EnumPrintersW GetPrinterW OpenPrinterW

ws2_32

WSAAsyncSelect

wsock32

htons

Name

.text

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

x86/ophcrack_nogui.exe

IMPHASH bc6af91bae6902a88acba7780f85b510
SHA256 fc90a0af0bf3ce78320b17e76b589a114bce7e5a9591d8f2fe029f00b3809ce3
MD5 0de8ac7bd0ffb4f74395154f2ad02a7a
SHA1 bc04ca05185046a170b1dd69f297c00ad44261ab
SHA512 a1667d9852aa8858d4bfba604e5d4ce704f168f08809dcc29a8ff24531b58de89c480ba82cbc24e929a7773be53cfcf58b4e6be908abb267c8f8934e0ba1ac0b
SSDEEP 24576:hYc2Ibs09mZCzseIATVErC3cqNw/lwFxm7voi9rWx/Mrs3ejF1S8:C09mD/lwFxEkMZjF1f
TLSH
T18C758D9DFFC68DE7EE11057689E6933B073AD6506253DBE3D718D038AC173522E8AA04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegisterEventSourceA ReportEventA

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FlushViewOfFile GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileSize GetFileType GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVolumeInformationA GlobalMemoryStatusEx HeapAlloc HeapFree InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection MapViewOfFile MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WriteFile

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstati64 _get_osfhandle _initterm _iob _lock _lseeki64 _onexit _setjmp3 _setmode _snwprintf time localtime exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos ftell fwprintf fwrite getenv malloc perror printf putchar puts raise realloc rewind signal strerror strncmp strtok _unlock _wfopen _write abort vfprintf wcscpy calloc longjmp _strdup _open _fileno _close _access

ntdll

NtFsControlFile NtOpenFile RtlInitUnicodeString RtlNtStatusToDosError _stricmp _ultoa _vsnprintf atoi floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncpy strtoul tolower toupper wcsstr

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA MessageBoxW

wsock32

htons

Name

.text

Size

374KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

440KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ophcrack-3.7.0-bin.zip

x64/ophcrack.exe

advapi32

comdlg32

gdi32

imm32

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

user32

winmm

winspool.drv

ws2_32

wsock32

generic

x64/ophcrack_nogui.exe

advapi32

kernel32

msvcrt

ntdll

user32

wsock32

generic

x86/ophcrack.exe

advapi32

comdlg32

gdi32

imm32

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

user32

winmm

winspool.drv

ws2_32

wsock32

generic

x86/ophcrack_nogui.exe

advapi32

kernel32

msvcrt

ntdll

user32

wsock32

generic