essential_extension_crosshair-v0[.]1[.]0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
essential_extension_crosshair-v0.1.0.exe
Size 10.2MB
Sample261102-nzwfpsht6v
SHA256 c848c83bcfdd5f9c54af004114051e168ffb45e2641ae09784a40d6bde04f110
MD5 3b1826f3530115ad2416c310cf372cab
SHA1 7dab9ea5c773dc800648d6ed1b25f37d45ec51f4
SHA512 0af8c79d084dcbf51c7cebee5d42226d38df60409f2d3c084a6d2081bcde584a118aa202a6534d02eb24aeecfd8301bd6f6e7c8b63076fb6e72e23b52a53cb53
SSDEEP 98304:3KsTFstqV0hBdfsam2AdeJB1erojj/KkpIv:3Ks4oIIKqIB1EmxpIv
TLSH
T143B6D6257B5E9968D057C474825E4AB3496030CE0B3969FF48B452B82F7EFF42F38269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
essential_extension_crosshair-v0.1.0.exe

File Explorer

essential_extension_crosshair-v0.1.0.exe

.exe 10.2MB

essential_extension_crosshair-v0.1.0.exe

IMPHASH d4aa27f1a443b7edea213318271f3da7
SHA256 c848c83bcfdd5f9c54af004114051e168ffb45e2641ae09784a40d6bde04f110
MD5 3b1826f3530115ad2416c310cf372cab
SHA1 7dab9ea5c773dc800648d6ed1b25f37d45ec51f4
SHA512 0af8c79d084dcbf51c7cebee5d42226d38df60409f2d3c084a6d2081bcde584a118aa202a6534d02eb24aeecfd8301bd6f6e7c8b63076fb6e72e23b52a53cb53
SSDEEP 98304:3KsTFstqV0hBdfsam2AdeJB1erojj/KkpIv:3Ks4oIIKqIB1EmxpIv
TLSH
T143B6D6257B5E9968D057C474825E4AB3496030CE0B3969FF48B452B82F7EFF42F38269
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7235712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

essential_extension_crosshair.pdb

bcryptprimitives

ProcessPrng

advapi32

EventUnregister EventWriteTransfer EventSetInformation RegGetValueW EventRegister RegOpenKeyExW RegQueryValueExW RegCloseKey

ntdll

NtWriteFile RtlGetVersion NtReadFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile

kernel32

RtlPcToFileHeader GetSystemTimeAsFileTime RaiseException EncodePointer SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive TlsAlloc LoadLibraryW LoadLibraryA ReleaseSRWLockExclusive TlsGetValue TlsSetValue TlsFree FindNextFileW GetTempPathW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW UnhandledExceptionFilter GetFinalPathNameByHandleW ReleaseMutex GetModuleHandleW WaitForSingleObjectEx WideCharToMultiByte SwitchToThread IsProcessorFeaturePresent GetCurrentThreadId GetUserDefaultUILanguage GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle LCIDToLocaleName lstrlenW GetCurrentProcess GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW SetUnhandledExceptionFilter InitializeSListHead RtlUnwindEx FreeLibrary GetModuleHandleA ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime IsDebuggerPresent SetFileInformationByHandle GetFullPathNameW LoadLibraryExA SetLastError HeapAlloc SleepEx WriteFileEx InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW Sleep CompareStringOrdinal FormatMessageW GetProcAddress GetFileInformationByHandle GetConsoleMode GetLastError CloseHandle DeleteCriticalSection CreateFileW WaitForSingleObject CreateMutexA GetEnvironmentVariableW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

SHGetKnownFolderPath SHCreateItemFromParsingName ShellExecuteW DragQueryFileW Shell_NotifyIconW DragFinish SHAppBarMessage Shell_NotifyIconGetRect

user32

GetMenuBarInfo DestroyMenu SendMessageW DrawIconEx GetMessageA CheckMenuItem GetMenuItemInfoW RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW AppendMenuW AdjustWindowRect RedrawWindow InsertMenuW IsIconic PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx RegisterClassW VkKeyScanW ScreenToClient GetWindowLongW CreateIcon GetAsyncKeyState MapVirtualKeyExW GetRawInputData SetWindowTextW GetWindowTextW GetWindowTextLengthW SetForegroundWindow DestroyIcon EnumDisplayMonitors MonitorFromPoint GetMenu IsWindowVisible SetWindowDisplayAffinity GetClientRect SystemParametersInfoA SetPropW OffsetRect EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor ClientToScreen RegisterRawInputDevices ReleaseCapture GetCursorPos MonitorFromWindow SetCapture MsgWaitForMultipleObjectsEx MonitorFromRect RegisterWindowMessageA SetParent MapWindowPoints GetMonitorInfoW GetSystemMetrics FillRect GetWindow SystemParametersInfoW GetWindowDC TrackMouseEvent ShowWindow ReleaseDC GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn DestroyWindow EnableWindow IsWindowEnabled IsProcessDPIAware GetDC GetTouchInputInfo CloseTouchInputHandle SendInput ToUnicodeEx GetKeyboardLayout GetKeyboardState AttachThreadInput GetWindowThreadProcessId GetKeyState CallNextHookEx SetWindowsHookExA SetCursor ValidateRect TranslateAcceleratorW SetWindowLongW EnumChildWindows DispatchMessageA RegisterClassExW PostThreadMessageW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx DefWindowProcW GetMessageW MapVirtualKeyW LoadCursorW PostMessageW GetForegroundWindow PeekMessageW DrawTextW RegisterTouchWindow IsWindow CreateWindowExW AdjustWindowRectEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos GetUpdateRect DispatchMessageW TranslateMessage SetFocus

ole32

CoTaskMemAlloc RevokeDragDrop CoCreateInstance OleInitialize CoInitializeEx CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler RegisterDragDrop

comctl32

TaskDialogIndirect DefSubclassProc SetWindowSubclass RemoveWindowSubclass

gdi32

SetBkMode CreateRectRgn CreateSolidBrush DeleteObject BitBlt SetTextColor CreateCompatibleDC DeleteDC CreateDIBSection GetDeviceCaps SelectObject CombineRgn

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

api-ms-win-crt-math-l1-1-0

pow roundf trunc __setusermatherr floor round

api-ms-win-crt-runtime-l1-1-0

_set_app_type abort _seh_filter_exe _c_exit terminate _crt_atexit _configure_narrow_argv _register_onexit_function _initialize_onexit_table _wassert _initialize_narrow_environment _get_initial_narrow_environment _initterm _register_thread_local_exe_atexit_callback _initterm_e __p___argc exit _cexit __p___argv _exit

api-ms-win-crt-heap-l1-1-0

calloc _callnewh malloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

wcscmp strlen wcslen _wcsicmp strcpy_s strcmp wcsncmp

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale