Crypter[.]rar | Triage™

General

Target
Crypter.rar
Size 398KB
Sample261022-yzmtnsft2s
SHA256 a2fbdea8e40dccb1f3c062eede1f141e12671bb5613170a4ec34d6b49bdaeaf5
MD5 7a4541a81601bceeded0dfa6accfd267
SHA1 77a01f75f9df6fc83d0e5ffb1c5116e8bb862ab0
SHA512 79fdb3152bb7daf41d2541f8f7ad648594e24c14445f411fb88d202837d571825e7c4319fbd77fe5097ac62015a4afafc2d13269cd40072daef595eaa867a124
SSDEEP 12288:keJmIYpm1EQlS/DMgYcQibQU7YEQ67/YtXf2+aYx7S:keJmS1EQlS/l1QiMMYA7QtXf2NYRS
TLSH
T1F38423B08DFE97509E7EAD5E25F08A45E6122C3B1F8A76A429ED3710F07D083683916D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/Crypter.exe	ConfuserEx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Crypter.exe

File Explorer

Crypter.rar

.rar 398KB
Crypter.exe

.exe 568KB

Crypter.rar

SHA256 a2fbdea8e40dccb1f3c062eede1f141e12671bb5613170a4ec34d6b49bdaeaf5
MD5 7a4541a81601bceeded0dfa6accfd267
SHA1 77a01f75f9df6fc83d0e5ffb1c5116e8bb862ab0
SHA512 79fdb3152bb7daf41d2541f8f7ad648594e24c14445f411fb88d202837d571825e7c4319fbd77fe5097ac62015a4afafc2d13269cd40072daef595eaa867a124
SSDEEP 12288:keJmIYpm1EQlS/DMgYcQibQU7YEQ67/YtXf2+aYx7S:keJmS1EQlS/l1QiMMYA7QtXf2NYRS
TLSH
T1F38423B08DFE97509E7EAD5E25F08A45E6122C3B1F8A76A429ED3710F07D083683916D
MD5 SHA1 SHA512 SSDEEP TLSH

Crypter.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 92e48aae0ee78436885af00cc82d87e3d9a428f99a5975e6fa4910f005ea807d
MD5 58a99836f405e63f51503346df7646e9
SHA1 909a79b6692fa74a0fe7ab819bad9b617b187412
SHA512 4eb76e811f74e3079c7122b3a57c6bf89690399262e315e3b71e283e7a9f455b79276f1406ed674c38b37958d2031222c713a077964535cd9aada8644dcc5061
SSDEEP 12288:iXAbRmBTdaCbSsxRMSOP0g8oRc7w6my161zeMpq:JbEBTdMOA0gNcMf1SMpq
TLSH
T1ADC4BF16CA14D8E9CC262134757BDD750A17BE7A8934049A13EE3E973EB6E02705FC8B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

311838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Crypter.rar

Crypter.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Crypter.rar

Crypter.exe

mscoree

dotnet