AdvancedMechanics crock.rar
- SHA256 4607b08c4062b109247ae70ff25add8efed591747d7b962ef9d8db3069b7a3b6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AdvancedMechanics crock/AdvancedMechanics/AMCRACK.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
AdvancedMechanics crock/AdvancedMechanics/AdvancedMechanics.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
General
- Target AdvancedMechanics crock.rar
- Size 13.5MB
- Sample260925-mcaeaatfkd
- SHA256 4607b08c4062b109247ae70ff25add8efed591747d7b962ef9d8db3069b7a3b6
- MD5 e4e08a5d7f85f282d93deef0c30685f9
- SHA1 d604b38142942ae43af3d3591766c18e27498835
- SHA512 2953127b5bc3f0ff13215dc49a357e6df6fbe7d377210109847f8eeb8ece79cd6797cc77d1f0c0e298684d306a44a7492437c9fb63125555e25716a8f06bfb7f
- SSDEEP 196608:kuDIuDZc/8YPpWM8hRpbgzJTmmDaiXnjqvIe6Lbm5JvHkQRLKp/YG1k65F0QYSab:p6/8s68dTi2Xemm5JvfLKpZZNln+
- TLSH T1F4E6330DEE1ED6B4888D7DDBF870934660B6C4AA525C4087DDDED1B068BE80DB0F664E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/AdvancedMechanics crock/AdvancedMechanics/AMCRACK.exe unpack001/AdvancedMechanics crock/AdvancedMechanics/AdvancedMechanics.exe
File Explorer
-
AdvancedMechanics crock.rar.rar 13.5MB
-
AdvancedMechanics crock/AdvancedMechanics/AMCRACK.exe.exe 10KB
-
AdvancedMechanics crock/AdvancedMechanics/AdvancedMechanics.exe.exe 15.1MB
AdvancedMechanics crock/AdvancedMechanics/AMCRACK.exe
- SHA256 93770202bd151660c9e6277c863f3e89cd797852d809514532315907d12efcf8
- MD5 2b1dde15530d58da02fb35c6168b5de7
- SHA1 a51421684aec930088424f6cf5d0ee2d1c8d3087
- SHA512 58d8f5948d9cc8289c93044ba14f2f7ea1809f83d5d3947fd0f076b8e8fd5eaf0b1cda83bffd29b7c066a2e2f1452527dd1fbc5ecfe5eae6956a0a87f6ddc131
- SSDEEP 192:NMKJBrMuj/wSUwlFDZQSNQFva8HrvUsZaQa8aeamwwRXXfobAPB0:Jv8sCFvzMskNhDmwwRXXfobu
- TLSH T18122B45AABE88904F4FF5B34E8724B01AA71B82B4E7AC74E04C504FD0E617E489D37A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
AdvancedMechanics crock/AdvancedMechanics/AdvancedMechanics.exe
- IMPHASH 7d3e820124cb86b0125026e3e5626036
- SHA256 c96ff8657be98f120a5d0a8ff779421e0882d13c0d5f5f395c59721713e8a36c
- MD5 585d48f187d8e43a8c190892bca99c60
- SHA1 a27f6e22082a3f9024607d274ef1b9c00f5f343b
- SHA512 fa1a262bc0bd6d0e4381aa05280bb518c8feff5e7c0323428cddddfe780212ea96497f5e29a620b12fd25c9ddb6c0bac0985a78603eff04bbd1278cda9e8cfc0
- SSDEEP 393216:ERY3Ndhd4g9mZVosVkEtplJkeKubkqk/F:x8ZCsiMlF2qEF
- TLSH T188F623C57BD4E2A8C0939A002BC763A9B0E5778F81FD4D5F39CB2C073951C2A8E5A975
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15036296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DCompile
dwmapi
DwmFlush
ole32
CoCreateInstance
winmm
timeEndPeriod
shlwapi
PathFindFileNameW
dbghelp
SymGetModuleInfoW64
version
VerQueryValueW
advapi32
RegCloseKey
crypt32
CertOpenStore
ws2_32
WSAEnumNetworkEvents
shell32
ShellExecuteW
wintrust
CryptCATAdminReleaseCatalogContext
ntdll
RtlLookupFunctionEntry
kernel32
SleepConditionVariableSRW
user32
GetForegroundWindow
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
imm32
ImmSetCandidateWindow
dnsapi
DnsFree
bcrypt
BCryptGenRandom
vcruntime140
memchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
localeconv
psapi
GetModuleInformation
Name
.text
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.0zZ
Size
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Y%5
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
./Q3
Size
15.1MB
Virtual Size
15.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ