deathware_cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
deathware_cracked.exe
Size 19.2MB
Sample261011-pc89qahe87
SHA256 30ee23a2e75a27ffc5a4531611a831dc8692db202d0330dfcd7707e634b14afd
MD5 6e2fa806cae0c24e923872146bcd5ec5
SHA1 30b6494dc674f714a24ea72bcd66c86112f1ce58
SHA512 10c293120bb8e9b80b0de2b80c60059683a8fdd81ebb967789c0377aa5e85fb76aa093864e74b229e15d2d1addac6daa2c930121180bb30053c54064c04a2844
SSDEEP 196608:TT+xkloWHLy1pMq7Hpv+ucLdr9kma5J+cEvwdAFNxL:fjloCO1pD7BcV9kn0cEvwdAF
TLSH
T1AE17AF0B77EBAC6ED207C5B4830543675A11B4CB2F26A5EB90C465397EADBE04F2CB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deathware_cracked.exe

File Explorer

deathware_cracked.exe

.exe 19.2MB

deathware_cracked.exe

IMPHASH 8ac66879949550f29af5c06cd676ba50
SHA256 30ee23a2e75a27ffc5a4531611a831dc8692db202d0330dfcd7707e634b14afd
MD5 6e2fa806cae0c24e923872146bcd5ec5
SHA1 30b6494dc674f714a24ea72bcd66c86112f1ce58
SHA512 10c293120bb8e9b80b0de2b80c60059683a8fdd81ebb967789c0377aa5e85fb76aa093864e74b229e15d2d1addac6daa2c930121180bb30053c54064c04a2844
SSDEEP 196608:TT+xkloWHLy1pMq7Hpv+ucLdr9kma5J+cEvwdAFNxL:fjloCO1pD7BcV9kn0cEvwdAF
TLSH
T1AE17AF0B77EBAC6ED207C5B4830543675A11B4CB2F26A5EB90C465397EADBE04F2CB05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7845648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GlobalLock OpenEventW FindClose FindNextFileW FindFirstFileExW SetLastError GlobalUnlock GetSystemTimePreciseAsFileTime GlobalAlloc LocalFree GlobalFree GetOverlappedResult CreateThread LoadLibraryW OpenProcess QueryFullProcessImageNameW GetExitCodeProcess ExitProcess WaitForMultipleObjects CreateEventW GetCurrentProcessId CreateIoCompletionPort GetThreadPriority WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW SetEvent GetModuleHandleW Sleep GetSystemInfo SetFileCompletionNotificationModes CloseHandle GetLastError SwitchToThread SetThreadPriority GetCurrentThreadId CreateEventA GetFinalPathNameByHandleW GetModuleHandleA PostQueuedCompletionStatus WaitForSingleObjectEx HeapReAlloc SetThreadStackGuarantee GetCurrentProcess GetCurrentThread HeapFree GetProcessHeap LoadLibraryA GetModuleFileNameW LoadLibraryExW SetThreadErrorMode FreeLibrary CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW HeapAlloc ReadFileEx SleepEx WriteFileEx SetHandleInformation GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx FlushFileBuffers CreateDirectoryW CancelIo ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle GetTempPathW DeleteFileW MoveFileExW LoadLibraryExA GetSystemTimeAsFileTime GlobalSize GetProcAddress GetQueuedCompletionStatusEx WaitForMultipleObjectsEx InitializeSListHead SetUnhandledExceptionFilter CheckRemoteDebuggerPresent GetThreadContext AddVectoredExceptionHandler QueryPerformanceCounter FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal FormatMessageW GetEnvironmentVariableW GetCurrentDirectoryW lstrlenW WideCharToMultiByte MultiByteToWideChar GetUserDefaultLangID GetUserDefaultUILanguage Module32NextW Module32FirstW Process32NextW Process32FirstW CreateToolhelp32Snapshot QueryPerformanceFrequency IsDebuggerPresent

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

ImpersonateAnonymousToken RevertToSelf RegQueryValueExW RegCloseKey RegOpenKeyExW

crypt32

CertVerifyCertificateChainPolicy CertCloseStore CertDuplicateStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertOpenStore CertAddCertificateContextToStore CertFreeCertificateChain CryptProtectData CertFreeCertificateContext CryptUnprotectData CertDuplicateCertificateContext CertGetCertificateChain

bcrypt

BCryptGenRandom

ws2_32

WSACleanup getaddrinfo freeaddrinfo recv send WSASend getsockopt connect bind WSAIoctl ioctlsocket WSASocketW closesocket shutdown setsockopt getpeername WSAGetLastError WSAStartup getsockname

ntdll

RtlVirtualUnwind NtDeviceIoControlFile RtlLookupFunctionEntry RtlCaptureContext NtReadVirtualMemory NtWriteVirtualMemory RtlNtStatusToDosError NtCancelIoFileEx NtCreateNamedPipeFile NtSetTimerResolution NtCreateFile NtWriteFile NtReadFile NtOpenFile

secur32

DecryptMessage EncryptMessage InitializeSecurityContextW DeleteSecurityContext FreeContextBuffer QueryContextAttributesW ApplyControlToken AcceptSecurityContext AcquireCredentialsHandleA FreeCredentialsHandle

oleaut32

SysFreeString GetErrorInfo SysAllocStringLen SafeArrayCreateVector SysStringLen SetErrorInfo SafeArrayPutElement

user32

SystemParametersInfoA ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout AdjustWindowRectEx GetWindowLongW SetWindowLongW EnableMenuItem GetSystemMenu ShowCursor ClipCursor GetClipCursor RegisterWindowMessageA GetClassInfoExW GetClassNameW SetClipboardData EmptyClipboard GetClipboardData IsClipboardFormatAvailable FlashWindowEx SetWindowTextW SetCursorPos GetWindowTextW GetWindowTextLengthW DestroyIcon CreateIcon ValidateRect GetRawInputData KillTimer SetTimer RegisterRawInputDevices EnumDisplayMonitors SetCursor LoadCursorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent ReleaseCapture SetCapture MonitorFromRect GetMenu RedrawWindow SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW InvalidateRgn SetWindowDisplayAffinity IsProcessDPIAware GetKeyState GetKeyboardState RegisterTouchWindow MonitorFromWindow SetForegroundWindow RegisterClassExW GetWindowLongPtrW PostMessageW CreateIconFromResourceEx SendMessageW GetSystemMetrics GetActiveWindow MessageBoxW SetWinEventHook GetWindowRect GetMonitorInfoW MonitorFromPoint SendInput MapVirtualKeyW ScreenToClient GetCursorPos GetAsyncKeyState IsIconic IsWindowVisible GetWindowThreadProcessId FillRect GetClientRect EnumWindows IsWindow DispatchMessageW TranslateMessage PeekMessageW DestroyWindow SetWindowPos ShowWindow SetLayeredWindowAttributes CreateWindowExW RegisterClassW ReleaseDC GetDC CallNextHookEx GetForegroundWindow UnhookWindowsHookEx GetMessageW SetWindowsHookExW CloseClipboard DefWindowProcW ClientToScreen SetPropW SetWindowLongPtrW GetPropW CallWindowProcW RemovePropW OpenClipboard

opengl32

wglDeleteContext wglGetCurrentContext wglMakeCurrent wglGetProcAddress wglGetCurrentDC wglCreateContext wglShareLists

shlwapi

AssocQueryStringW

shell32

DragQueryFileW DragFinish

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject DescribePixelFormat ChoosePixelFormat CreateRectRgn SetPixelFormat SwapBuffers Polygon GetTextExtentPoint32W TextOutW SetTextAlign SetTextColor CreateFontW SetDCBrushColor Ellipse DeleteDC DeleteObject BitBlt PolyPolyline SetDCPenColor PatBlt SetBkMode GetStockObject GetDeviceCaps

winmm

timeBeginPeriod

uiautomationcore

UiaLookupId UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent

ole32

CoInitializeEx RegisterDragDrop CoCreateInstance CoUninitialize CoTaskMemFree RevokeDragDrop OleInitialize

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmAssociateContextEx ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW ImmGetContext

uxtheme

SetWindowTheme

vcruntime140

__current_exception memcpy __CxxFrameHandler3 __current_exception_context __C_specific_handler memmove memcmp _CxxThrowException memset

api-ms-win-crt-math-l1-1-0

acosf __setusermatherr fmod atan pow floor trunc fmodf ceil exp2f cbrtf powf cos sin exp2 truncf ceilf floorf tanhf tanf atanf cosf expf round sinf roundf fmaf atan2f _hypotf

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _crt_atexit __p___argv _cexit __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table terminate _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free