setup_W8UL2hAS714_cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
setup_W8UL2hAS714_cracked.exe
Size 1.8MB
Sample261012-rl2mcasw2k
SHA256 7562f513bfd0cdf1a9c636ff78ae1b77890327c33bbbb779af93ffd0ea793413
MD5 c383dcf7e7e1408b6bf589280351c379
SHA1 815fca9cf12d2c7e3ac95cd8235bc19ff5eac6ce
SHA512 72ff4eb6faa18f3bd94726541b406da564b877db8eaf3d32d0f220068fa46fe0c3b591aab7222c6d839111f76c1d0c3258abdb4aa8fd048ce291b0e29866861f
SSDEEP 24576:UjM6nV8u3JyPs5o9l6gTdBBz/q33vB6/GEDZznqnCV8TrzA8FbQycQ42BSmgfvAq:SdRJQ+KS3fBAnMCKTQ8dyQ42BwvAq
TLSH
T1BC859DBDA3B08298D056E6B484836827F6B238655378FBEB93C04D611F567E04BB7731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup_W8UL2hAS714_cracked.exe

File Explorer

setup_W8UL2hAS714_cracked.exe

.exe 1.8MB

setup_W8UL2hAS714_cracked.exe

IMPHASH d88578f79e484ce08f0a24cd6476e297
SHA256 7562f513bfd0cdf1a9c636ff78ae1b77890327c33bbbb779af93ffd0ea793413
MD5 c383dcf7e7e1408b6bf589280351c379
SHA1 815fca9cf12d2c7e3ac95cd8235bc19ff5eac6ce
SHA512 72ff4eb6faa18f3bd94726541b406da564b877db8eaf3d32d0f220068fa46fe0c3b591aab7222c6d839111f76c1d0c3258abdb4aa8fd048ce291b0e29866861f
SSDEEP 24576:UjM6nV8u3JyPs5o9l6gTdBBz/q33vB6/GEDZznqnCV8TrzA8FbQycQ42BSmgfvAq:SdRJQ+KS3fBAnMCKTQ8dyQ42BwvAq
TLSH
T1BC859DBDA3B08298D056E6B484836827F6B238655378FBEB93C04D611F567E04BB7731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

675764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetCloseHandle InternetConnectA InternetOpenUrlA InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetOpenA

shell32

SHGetFolderPathA ShellExecuteA

advapi32

GetUserNameA InitializeSecurityDescriptor InitializeAcl RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptDestroyKey CryptReleaseContext SetSecurityDescriptorDacl OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation SetKernelObjectSecurity CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus ConvertSidToStringSidA CryptAcquireContextA

user32

DispatchMessageA PeekMessageA PostMessageA DefWindowProcA PostQuitMessage UnregisterClassA RegisterClassExA CreateWindowExA wsprintfW wsprintfA DestroyWindow ShowWindow SetWindowPos SetCapture ReleaseCapture GetSystemMetrics UpdateWindow SetWindowRgn SetWindowTextA GetClientRect TranslateMessage GetWindowRect MessageBoxA GetCursorPos LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout OpenClipboard GetClipboardData SetClipboardData CloseClipboard EmptyClipboard

gdi32

CreateRoundRectRgn

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGenRandom

iphlpapi

GetAdaptersAddresses

tbs

Tbsip_Context_Close Tbsi_Context_Create

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

urlmon

URLDownloadToFileA

ole32

CoUninitialize CoInitializeEx

kernel32

ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidCodePage GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile WriteConsoleW InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo IsValidLocale CompareFileTime GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileAttributesW GetFileAttributesExA GetFileSize ReadFile WriteFile GetTempPathA GetVolumeInformationA OutputDebugStringA CloseHandle SetUnhandledExceptionFilter GetLastError SetErrorMode QueryPerformanceCounter SetEvent WaitForSingleObject CreateEventA CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess ResumeThread CreateProcessA OpenProcess GetTickCount GetTickCount64 GetSystemDirectoryA GetSystemDirectoryW GetWindowsDirectoryA FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA LoadLibraryExA LocalFree MoveFileExA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW RtlUnwind CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetProcessTimes CreateProcessW ReadProcessMemory GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MoveFileExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetThreadContext SetThreadContext VirtualAllocEx VirtualProtectEx WriteProcessMemory GetExitCodeThread DebugSetProcessKillOnExit GetSystemFirmwareTable FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW CreateFileW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

866KB

Virtual Size

865KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

414KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

523KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

setup_W8UL2hAS714_cracked.exe

d3d11

wininet

shell32

advapi32

user32

gdi32

bcrypt

iphlpapi

tbs

dwmapi

urlmon

ole32

kernel32

imm32

d3dcompiler_47

generic