Xeno Temp Cracked By 0Xploit[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Xeno Temp Cracked By 0Xploit.exe
Size 2.4MB
Sample260926-2qphpavzey
SHA256 f40c2b97b7fd6dc9fa663e67be5c2775c7f6143ddae17e6aebdeb5c3e5757001
MD5 3b974adad2b950d8037ae9a19e02dad2
SHA1 74170b9af37593ebfd3b810cace2660b0af591f5
SHA512 39951471fa97617757ed2ecb68df6f3d259b27edc7e3a248b8c7388c3bc1f33210de71fa8dcdeb4a7f2f9307aca9a0f84d8ed638cb037b4b818f847f09e37364
SSDEEP 49152:7wx0k85P8K2ixMwjzMccVEB3n/sUEJM34:EKrMGzMvM3
TLSH
T141B5BE03A3A842E9C1679138C6668717F7B178451F20DBCB23E45EA96F63AE01F7B351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xeno Temp Cracked By 0Xploit.exe

File Explorer

Xeno Temp Cracked By 0Xploit.exe

.exe 2.4MB

Xeno Temp Cracked By 0Xploit.exe

IMPHASH e005cebe97dc9b81f496b9b887ef7279
SHA256 f40c2b97b7fd6dc9fa663e67be5c2775c7f6143ddae17e6aebdeb5c3e5757001
MD5 3b974adad2b950d8037ae9a19e02dad2
SHA1 74170b9af37593ebfd3b810cace2660b0af591f5
SHA512 39951471fa97617757ed2ecb68df6f3d259b27edc7e3a248b8c7388c3bc1f33210de71fa8dcdeb4a7f2f9307aca9a0f84d8ed638cb037b4b818f847f09e37364
SSDEEP 49152:7wx0k85P8K2ixMwjzMccVEB3n/sUEJM34:EKrMGzMvM3
TLSH
T141B5BE03A3A842E9C1679138C6668717F7B178451F20DBCB23E45EA96F63AE01F7B351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1202076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Desktop\Enigma Temp\Enigma Temp\x64\Release\Spectacle.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

TerminateProcess IsProcessorFeaturePresent GetStartupInfoW FindFirstFileW FindClose GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead CreateDirectoryW OutputDebugStringW GetCurrentDirectoryW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive GetFileAttributesExW HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy ReleaseSRWLockExclusive GetFileInformationByHandleEx GetLocaleInfoEx CheckRemoteDebuggerPresent IsDebuggerPresent GetModuleHandleW ExitProcess GetThreadContext CreateFileMappingA GetFileSizeEx CreateFileA WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExA GetTickCount VerifyVersionInfoA GetSystemDirectoryA SleepEx LeaveCriticalSection EnterCriticalSection LocalFree FormatMessageA SetLastError GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile DeleteCriticalSection CreateFileW Process32FirstW GetCurrentThread Process32NextW CreateToolhelp32Snapshot WaitForSingleObject GetCurrentProcess WriteProcessMemory CreateProcessA CloseHandle Sleep QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetLastError GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree SetUnhandledExceptionFilter GlobalAlloc MultiByteToWideChar GetProcessHeap InitializeCriticalSectionEx AreFileApisANSI

user32

GetWindowRect SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout MoveWindow ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState BlockInput MessageBoxA UpdateWindow PostQuitMessage TranslateMessage SetLayeredWindowAttributes PeekMessageW SetWindowLongA DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW TrackMouseEvent GetSystemMetrics GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW

advapi32

GetUserNameA GetLengthSid GetTokenInformation CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData IsValidSid CopySid ConvertSidToStringSidA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash OpenProcessToken

shell32

ShellExecuteA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SysFreeString SafeArrayGetLBound SafeArrayGetElement SysAllocString VariantClear SafeArrayGetUBound

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

msvcp140

?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setf@ios_base@std@@QEAAHHH@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bid@locale@std@@QEAA_KXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?uncaught_exception@std@@YA_NXZ _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?always_noconv@codecvt_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

normaliz

IdnToAscii

wldap32

ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord41 ord30 ord46 ord217 ord143 ord50 ord45 ord60 ord211 ord200 ord301

crypt32

CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertCloseStore CryptQueryObject CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertGetNameStringA CertFindExtension CertAddCertificateContextToStore

ws2_32

htonl closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept gethostname listen ioctlsocket __WSAFDIsSet ntohl select sendto recvfrom freeaddrinfo getaddrinfo

shlwapi

PathFindFileNameW

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strstr strchr _CxxThrowException memchr memcmp memcpy __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler longjmp strrchr memset memmove

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _invalid_parameter_noinfo_noreturn terminate _configure_narrow_argv _errno system strerror __sys_nerr _invalid_parameter_noinfo _resetstkoflw exit _getpid abort _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _beginthreadex

api-ms-win-crt-math-l1-1-0

_dsign roundf sqrtf acosf ceilf cosf fmodf powf sinf __setusermatherr

api-ms-win-crt-string-l1-1-0

tolower wcslen strlen _strdup isupper strncmp strpbrk strncpy strcmp strcspn strspn strnlen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vfprintf fwrite _wfopen fseek _lseeki64 __stdio_common_vsprintf fread __stdio_common_vsscanf feof fputs fopen _read _write _close _open fclose fputc fgetc fflush fgetpos _pclose fgets _set_fmode __acrt_iob_func ftell setvbuf _popen _get_stream_buffer_pointers _fseeki64 fsetpos ungetc

api-ms-win-crt-heap-l1-1-0

malloc free realloc _set_new_mode _callnewh calloc

api-ms-win-crt-convert-l1-1-0

strtoull strtol strtoul strtoll strtod atoi

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlink _access _stat64 _unlock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

strftime _localtime64 _time64 _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv