crypted_3F471AF8[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
crypted_3F471AF8.exe
Size 12.7MB
Sample260917-3aybbseb87
SHA256 80e9dfca19c52946cc7705a3479125507196f6462a5ec34a0ac0bdc860a88468
MD5 ca5a6edd2584aa6c12419e4547fa9e47
SHA1 a4fa0e4ebd0267694f2a8301090cc20a5e09a163
SHA512 4a3e17fb18a1c961398133800b7b23314552a2c43157149ef717a3889fd0401b0b074d64655a33da9ebc2331bb999c2f163e38910aa5b9c5aacf936102890068
SSDEEP 393216:UT2pEawTkvj4W9+SxsroI+ew2mUYP3kU5Y2P:UMDwQ74obxsrot2nY/kU5Y2P
TLSH
T13AD62366E6A665E1C47BC03DD642951EF91034AB833866FFB2C54E902B917E4EF3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crypted_3F471AF8.exe

File Explorer

crypted_3F471AF8.exe

.exe 12.7MB

crypted_3F471AF8.exe

IMPHASH 8dec40787aa5e7d68d00f1c07087b8c5
SHA256 80e9dfca19c52946cc7705a3479125507196f6462a5ec34a0ac0bdc860a88468
MD5 ca5a6edd2584aa6c12419e4547fa9e47
SHA1 a4fa0e4ebd0267694f2a8301090cc20a5e09a163
SHA512 4a3e17fb18a1c961398133800b7b23314552a2c43157149ef717a3889fd0401b0b074d64655a33da9ebc2331bb999c2f163e38910aa5b9c5aacf936102890068
SSDEEP 393216:UT2pEawTkvj4W9+SxsroI+ew2mUYP3kU5Y2P:UMDwQ74obxsrot2nY/kU5Y2P
TLSH
T13AD62366E6A665E1C47BC03DD642951EF91034AB833866FFB2C54E902B917E4EF3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

387729

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\black\source\repos\crypter\x64\Debug\crypter.pdb

kernel32

CloseHandle WaitForSingleObject ExitProcess CreateProcessW GetModuleFileNameW GetModuleHandleW FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc IsDebuggerPresent GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar RaiseException GetCurrentThreadId GetProcAddress GetTempPathW GetTempFileNameW GetLastError DeleteFileW

user32

LoadCursorW wsprintfW GetMessageW TranslateMessage DispatchMessageW SendMessageW DefWindowProcW PostQuitMessage RegisterClassExW MessageBoxW LoadIconW SetWindowTextW UpdateWindow SendDlgItemMessageW SetDlgItemTextW CreateWindowExW

comdlg32

GetOpenFileNameW

msvcp140d

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z

comctl32

InitCommonControlsEx

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptGenRandom BCryptCloseAlgorithmProvider BCryptDecrypt BCryptEncrypt BCryptOpenAlgorithmProvider BCryptSetProperty

vcruntime140d

memcmp __C_specific_handler __C_specific_handler_noexcept __std_type_info_destroy_list __current_exception __current_exception_context __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memmove _CxxThrowException __std_exception_destroy __std_exception_copy memset memcpy memchr

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_rotl _free_dbg _malloc_dbg _callnewh malloc _CrtDbgReportW _seh_filter_exe _set_app_type __setusermatherr _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_fmode __p___argc __p___argv _cexit _c_exit _lock_file _configthreadlocale _set_new_mode __p__commode _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit strcpy_s strcat_s __stdio_common_vsprintf_s terminate _wmakepath_s _wsplitpath_s wcscpy_s ungetc fclose _get_stream_buffer_pointers _CrtDbgReport wcslen wcscat_s setvbuf fwrite _unlock_file _fseeki64 fsetpos fread fputc fgetpos fgetc _register_thread_local_exe_atexit_callback fflush

Name

.textbss

Size

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

775KB

Virtual Size

775KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

581B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

crypted_3F471AF8.exe

kernel32

user32

comdlg32

msvcp140d

comctl32

bcrypt

vcruntime140d

vcruntime140_1d

ucrtbased

generic