Crescent-Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Crescent-Installer.exe
Size 4.6MB
Sample261009-pz7dmsgv81
SHA256 981a87dc29a849711f241de4a6b2089af88cc6f56d2ade35824c8e3148ef539d
MD5 a5e8676353ac96dfedd0dce9eef3a1be
SHA1 f2b94368e4e4ec338f13f528eff6e59b852f57c8
SHA512 9d4af4adf13edf626ad1d03ebcc3c0d665db73e3634d30e410bc9457d5381f05889974bebac5bfca28b63dd2aeecbba855fd2edad14552c113df50a6a9297033
SSDEEP 49152:fRK+lgTve2UmAyGvMrhqMH59guvy6dgqS+27q8v/JD4Bzrt5vVTGsK6y4ge9AuTI:fnmAytHbbgojzulayn+MT
TLSH
T103266C43F27180E8C06EC178C35AA633E7327889493476EB57E45B212F6AF906F2D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Crescent-Installer.exe

File Explorer

Crescent-Installer.exe

.exe 4.6MB

Crescent-Installer.exe

IMPHASH 1a577f6b5177994ba1c937bc4831af70
SHA256 981a87dc29a849711f241de4a6b2089af88cc6f56d2ade35824c8e3148ef539d
MD5 a5e8676353ac96dfedd0dce9eef3a1be
SHA1 f2b94368e4e4ec338f13f528eff6e59b852f57c8
SHA512 9d4af4adf13edf626ad1d03ebcc3c0d665db73e3634d30e410bc9457d5381f05889974bebac5bfca28b63dd2aeecbba855fd2edad14552c113df50a6a9297033
SSDEEP 49152:fRK+lgTve2UmAyGvMrhqMH59guvy6dgqS+27q8v/JD4Bzrt5vVTGsK6y4ge9AuTI:fnmAytHbbgojzulayn+MT
TLSH
T103266C43F27180E8C06EC178C35AA633E7327889493476EB57E45B212F6AF906F2D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3418736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Crescent_Installer.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtDeviceIoControlFile NtOpenFile NtCreateFile RtlGetVersion NtWriteFile NtCancelIoFileEx NtReadFile

kernel32

GetCurrentThread RtlPcToFileHeader LoadLibraryA RaiseException HeapFree GetProcessHeap GetUserDefaultUILanguage FlsGetValue EncodePointer SetThreadStackGuarantee LoadLibraryW GetSystemTimePreciseAsFileTime InitializeSListHead RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex FormatMessageW WaitForSingleObject MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber GetSystemTimeAsFileTime SleepEx SetHandleInformation ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle GetExitCodeProcess GetModuleHandleW SetUnhandledExceptionFilter GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SleepConditionVariableSRW GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler GetCommandLineW SetEnvironmentVariableW GetModuleHandleA Sleep GetProcAddress lstrlenW WakeAllConditionVariable SetFilePointerEx CreateWaitableTimerExW DeleteFileW GetTempPathW GetFileAttributesW CreateProcessW CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime GetFullPathNameW CloseHandle CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle AcquireSRWLockExclusive CreateMutexA SetNamedPipeHandleState CreateFileW CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW DeleteCriticalSection FindNextFileW FindFirstFileExW GetSystemInfo FindClose GetLastError SwitchToThread ReleaseSRWLockExclusive HeapReAlloc QueryPerformanceFrequency RtlUnwindEx LCIDToLocaleName FreeLibrary InitializeCriticalSectionEx SetWaitableTimer LoadLibraryExA SetLastError LoadLibraryExW OutputDebugStringW OutputDebugStringA

user32

LoadCursorW AdjustWindowRect RedrawWindow EnumDisplayMonitors PostMessageW GetWindowLongPtrW GetMessageW GetForegroundWindow FlashWindowEx TranslateMessage DispatchMessageW SetCursorPos RegisterTouchWindow IsWindow IsWindowEnabled InvalidateRect IsIconic IsWindowVisible EnableWindow DestroyWindow PostThreadMessageW SetPropW MonitorFromRect SystemParametersInfoW UpdateWindow ClipCursor GetSystemMetrics GetAsyncKeyState GetClipCursor ShowCursor DefWindowProcW GetKeyState RegisterRawInputDevices SetWindowTextW GetWindowTextW PeekMessageW MsgWaitForMultipleObjectsEx GetWindowTextLengthW GetRawInputData ValidateRect GetUpdateRect MapVirtualKeyW ScreenToClient ReleaseCapture ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState MonitorFromPoint SetCapture GetMonitorInfoW CloseTouchInputHandle GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW TrackMouseEvent AdjustWindowRectEx GetMenu GetWindowLongW SetWindowLongW GetSystemMenu FindWindowExW InvalidateRgn RegisterWindowMessageA IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu GetParent SetCursor SetWindowRgn SetWindowLongPtrW EnumChildWindows DispatchMessageA GetMessageA SetWindowPos CreateWindowExW RegisterClassExW GetWindow GetMenuItemInfoW TranslateAcceleratorW SetFocus SetWindowDisplayAffinity SetParent GetTouchInputInfo

comctl32

DefSubclassProc TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

ole32

RevokeDragDrop CoCreateFreeThreadedMarshaler CoInitializeEx RegisterDragDrop CoTaskMemFree CoTaskMemAlloc CoUninitialize CoCreateInstance OleInitialize

shell32

DragQueryFileW SHAppBarMessage DragFinish SHGetKnownFolderPath ShellExecuteW

gdi32

DeleteDC CombineRgn CreateRectRgn CreateCompatibleDC BitBlt CreateSolidBrush CreateDIBSection DeleteObject GetDeviceCaps SelectObject SetTextColor SetBkMode

advapi32

RegQueryValueExW RegCloseKey RegGetValueW RegOpenKeyExW EventWriteTransfer EventRegister SystemFunction036 EventUnregister EventSetInformation

ws2_32

shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind WSASend connect ioctlsocket WSASocketW recv closesocket WSAIoctl getsockname WSAGetLastError getpeername getsockopt

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s strlen wcslen wcscmp

api-ms-win-crt-math-l1-1-0

pow round roundf floor __setusermatherr trunc

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _seh_filter_exe _initialize_narrow_environment _register_onexit_function _configure_narrow_argv _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initterm _initterm_e _set_app_type _c_exit _cexit _crt_atexit abort exit _exit _wassert terminate __p___argc __p___argv

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale