CrackTap[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CrackTap.exe
Size 5.7MB
Sample261022-v2jm9aah47
SHA256 b2885e8403c92fc26e05726229002a9548bb4ad84a67dddc7c543619befae796
MD5 482800610b88e1c7bf006870eb50154c
SHA1 6c6a8ab8c5b973d95ad2dc067162807dda8035fe
SHA512 b263673b6af82a37cd05241144cccecb3370f1f06fe9e8b34cb17fcef1e650e0d3456b9195aec6af2d0d3bf14d750fc5def046c78fa12dbd4a0526044a731ad5
SSDEEP 98304:24Fa8oVfIwb/aR3HNHS0GEFoUu1zPClpEL4DCwUIafG0k64P2d+iZS2Gdp:1FReC3HNHtGEFozPJ9G0k6rk2m
TLSH
T17456F1A9739052F8C027C974C963BA0FF672B4090B3486EB37D166906FB79D49E7A701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CrackTap.exe

File Explorer

CrackTap.exe

.exe 5.7MB

CrackTap.exe

IMPHASH 62b308f7b47a5998821ce99e117c0d51
SHA256 b2885e8403c92fc26e05726229002a9548bb4ad84a67dddc7c543619befae796
MD5 482800610b88e1c7bf006870eb50154c
SHA1 6c6a8ab8c5b973d95ad2dc067162807dda8035fe
SHA512 b263673b6af82a37cd05241144cccecb3370f1f06fe9e8b34cb17fcef1e650e0d3456b9195aec6af2d0d3bf14d750fc5def046c78fa12dbd4a0526044a731ad5
SSDEEP 98304:24Fa8oVfIwb/aR3HNHS0GEFoUu1zPClpEL4DCwUIafG0k64P2d+iZS2Gdp:1FReC3HNHtGEFozPJ9G0k6rk2m
TLSH
T17456F1A9739052F8C027C974C963BA0FF672B4090B3486EB37D166906FB79D49E7A701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1190800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoInitialize CoCreateInstance CoInitializeEx CoUninitialize

shlwapi

SHDeleteKeyW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpQueryOption WinHttpSetTimeouts WinHttpCloseHandle WinHttpSendRequest WinHttpSetOption WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest

crypt32

CryptUnprotectData CryptProtectData CertFreeCertificateChain CryptEncodeObjectEx CertFreeCertificateContext CertGetCertificateChain

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptHashData BCryptDecrypt BCryptSetProperty BCryptGenerateSymmetricKey BCryptDestroyKey BCryptGetProperty

kernel32

QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter OutputDebugStringA GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetSystemFirmwareTable SizeofResource GetVolumeInformationW GetCurrentProcess TerminateProcess GetModuleFileNameW GetEnvironmentVariableW InitializeCriticalSectionEx CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW GetCurrentThread LockResource Process32FirstW CloseHandle LoadResource FindResourceW DecodePointer GetThreadContext DeleteCriticalSection GetComputerNameW GetCurrentProcessId SystemTimeToFileTime CreateProcessW GetModuleHandleW QueryFullProcessImageNameW GetSystemTimeAsFileTime GetTickCount SetConsoleTitleW GetProcessTimes IsDebuggerPresent CheckRemoteDebuggerPresent IsWow64Process ExitProcess ReadFile GetLogicalDrives GetFileSizeEx GetFileAttributesW GetDriveTypeW GetFileAttributesA GetCommandLineW WaitForSingleObject LocalFree ReadProcessMemory AllocConsole WriteFile MoveFileExW FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ResumeThread Thread32Next Thread32First GetCurrentThreadId GetNativeSystemInfo CreateActCtxW GetTempPathW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetSystemDirectoryW DeactivateActCtx MultiByteToWideChar Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW DuplicateHandle ResetEvent DeviceIoControl CreateNamedPipeW TerminateThread CreateThread GetExitCodeThread WriteProcessMemory VirtualProtectEx VirtualAllocEx CreateRemoteThread VirtualFreeEx SetThreadContext VirtualQueryEx SuspendThread GetThreadTimes OpenThread GetSystemInfo LoadLibraryW FlsFree FlsSetValue GetModuleHandleExW FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry OutputDebugStringW GetCPInfo LCMapStringEx EncodePointer GetStringTypeW RaiseException RtlPcToFileHeader GetLogicalProcessorInformationEx WaitForSingleObjectEx GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW GetConsoleMode GetLocaleInfoA GetModuleHandleA ReadConsoleW GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ExitThread FreeLibraryAndExitThread HeapSize WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStdHandle GetCommandLineA LoadLibraryA SetFilePointerEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteConsoleW SetEndOfFile GetSystemWow64DirectoryW RtlUnwind

user32

GetWindowRect IsWindowVisible SetWindowLongPtrW GetWindowLongPtrW IsWindow GetMonitorInfoW EnumWindows UpdateLayeredWindow MessageBoxW DestroyWindow SetWindowPos GetDpiForWindow SetActiveWindow CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow GetWindowThreadProcessId LoadImageW UnregisterClassW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetKeyState GetMessageExtraInfo GetDC MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos wsprintfW MonitorFromPoint SetForegroundWindow ReleaseDC

gdi32

GetDeviceCaps DeleteObject DeleteDC SelectObject CreateDIBSection CreateCompatibleDC

advapi32

CryptGetHashParam RegQueryValueExW RegOpenKeyExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash GetTokenInformation CryptReleaseContext RegGetValueW GetUserNameA RegCloseKey

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteExW

oleaut32

SysFreeString

dwmapi

DwmSetWindowAttribute

imm32

ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmReleaseContext

d3d9

Direct3DCreate9

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

309KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

653KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CrackTap.exe

ole32

shlwapi

winhttp

crypt32

bcrypt

kernel32

user32

gdi32

advapi32

shell32

oleaut32

dwmapi

imm32

d3d9

generic