coldperm cracked.zip
- SHA256 2bc7f3ffb56b51d39a48f7ca8190b14a274acffec508fd9048952fff0bc99f09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
coldperm cracked/coldperm cracked.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
coldperm cracked/coldperm cracked.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target coldperm cracked.zip
- Size 4.7MB
- Sample261014-bs8q8sea62
- SHA256 2bc7f3ffb56b51d39a48f7ca8190b14a274acffec508fd9048952fff0bc99f09
- MD5 87c1c4ad8903f0c411b354e5b407a8b9
- SHA1 0728c61f53829d0e3d2bbcd9702b952a20c814bd
- SHA512 16486838d34e651e8df6aa3c69e3cd9029663d676cb771e0dcfba082d216425f53d304cf0e0447c8a613f66fad27c4e88bb7be4e8d228f98079653c2d35730b5
- SSDEEP 98304:Ksx0T5qoSoLnCIZXOmdS/ro7Wrh0PuxPH+m4EJPsJAsE+TW+zbCnAOGRrIuzOQfE:Ks+TNzdXRdS07sCmRHHkJZrTz+ARRMQ8
- TLSH T1C636339B7A46027E8F5F0B43957122B0510FCAD76FC6BA83C34A748326A77C5C1A93E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/coldperm cracked/coldperm cracked.exe
File Explorer
-
coldperm cracked.zip.zip 4.7MB
-
coldperm cracked/coldperm cracked.exe.exe 6.7MB
coldperm cracked/coldperm cracked.exe
- IMPHASH ab1e82aa4280fdd1d26aaa6c116151c0
- SHA256 bc6818240b6af1141afadc512960f0dc5b3d4122741c717b6dad1fe73efd8f52
- MD5 ffdc7159548e1dfd1a4bf0ff043c2618
- SHA1 a60df92c4ce7513e2454da6aac7455963fa89863
- SHA512 ec6f032cf52b5febc02752dc42c1f6e71f6c977f3f5ac58f7036e2e583c43190d729a7c6a32fc8e37dca5384016acc45855e003849abbb95db72fb0505822091
- SSDEEP 49152:MevGNemJWJN4x9khvbqy+EyaCBuuPbS6apBkHo//yTJYE33O9ZWpgYApt/U29u1K:M
- TLSH T15F6602318A842FF9CEA85A3890FE161D5FE05A8B5025B54EEF637D07BFEB904450B1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount64
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
OpenProcess
OutputDebugStringA
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
ucrtbase
__C_specific_handler
__acrt_iob_func
__daylight
__intrinsic_setjmpex
__p___argc
__p___argv
__p___wargv
__p__commode
__p__environ
__p__fmode
__p__wenviron
__setusermatherr
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vswprintf
__timezone
__tzname
_beginthreadex
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_endthreadex
_errno
_exit
_fileno
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_lock_file
_set_app_type
_set_invalid_parameter_handler
_set_new_mode
_setmode
_strdup
_tzset
_ultoa
_unlock_file
_wfopen
abort
calloc
clearerr
exit
fclose
ferror
fflush
fgetwc
fputc
free
fwrite
getc
localeconv
longjmp
malloc
mbrtowc
memcpy
memmove
memset
realloc
setvbuf
signal
strerror
strlen
strncmp
system
wcrtomb
wcslen
Name
.text
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
6.6MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
332B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ