Sina Perm CRACKED BY SAFWAN120[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Sina Perm CRACKED BY SAFWAN120.exe
Size 2.7MB
Sample261107-sdw8bsy1cv
SHA256 3035b30abe7c21186802f235084275a0effa887cee4b6e2736c443dff2901735
MD5 ff28d996149f2b677f4ccb89ba421983
SHA1 51de7a7c38d05b6e883de32b15252a705104a392
SHA512 828d1140905a47e6b8ea7f4989194f3c7a20f400da4bf00fd997e61ba32ec653c9cce69a799795938972f30c5961923db5bb0926b17c5d1d5ea7fb3ca72f454b
SSDEEP 49152:V8q3njzIjDlnygMqfWjOFlW6cbODw7gOuUEMKnp/6n4OdFj:p3jzNklW6cbODw7gOuUvb4Ov
TLSH
T188D5BE07E36442ECC96B9538C6A68B47F3B5B8442311D7CF22E46B596F536E01F7A3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Sina Perm CRACKED BY SAFWAN120.exe

File Explorer

Sina Perm CRACKED BY SAFWAN120.exe

.exe 2.7MB

Sina Perm CRACKED BY SAFWAN120.exe

IMPHASH eed2de612ae14f25065036c3c8b3fbf0
SHA256 3035b30abe7c21186802f235084275a0effa887cee4b6e2736c443dff2901735
MD5 ff28d996149f2b677f4ccb89ba421983
SHA1 51de7a7c38d05b6e883de32b15252a705104a392
SHA512 828d1140905a47e6b8ea7f4989194f3c7a20f400da4bf00fd997e61ba32ec653c9cce69a799795938972f30c5961923db5bb0926b17c5d1d5ea7fb3ca72f454b
SSDEEP 49152:V8q3njzIjDlnygMqfWjOFlW6cbODw7gOuUEMKnp/6n4OdFj:p3jzNklW6cbODw7gOuUvb4Ov
TLSH
T188D5BE07E36442ECC96B9538C6A68B47F3B5B8442311D7CF22E46B596F536E01F7A3A0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1395224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hash\Desktop\SinaPerm\Verse-ui_-master V2\x64\Release\Verse ui.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind AreFileApisANSI RtlLookupFunctionEntry RtlCaptureContext GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW VerifyVersionInfoW GetCurrentProcessId WaitForMultipleObjects GetFileInformationByHandleEx CheckRemoteDebuggerPresent IsDebuggerPresent ExitProcess Sleep GetModuleHandleW CreateProcessW PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW GetTickCount GetSystemInfo SleepEx GetSystemDirectoryW LocalFree LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleFileNameW CreateFileA GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateFileW GetLastError AddVectoredExceptionHandler CloseHandle WaitForSingleObject CreatePipe GetCurrentProcess ReadFile LoadLibraryW QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency WakeAllConditionVariable LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree HeapDestroy HeapSize InitializeCriticalSectionEx DeleteCriticalSection CreateThread VirtualProtect GlobalAlloc MultiByteToWideChar CreateFileMappingW GetModuleFileNameA

user32

SetClipboardData GetWindowLongW DefWindowProcW DestroyWindow MessageBoxW CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MessageBoxA SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow GetWindowRect MoveWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData

advapi32

CopySid SetSecurityInfo RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation GetLengthSid ConvertSidToStringSidA AddAccessAllowedAce SystemFunction036 CryptDestroyKey CheckTokenMembership FreeSid OpenProcessToken AllocateAndInitializeSid CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptImportKey CryptEncrypt

shell32

ShellExecuteA ShellExecuteW

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xbad_function_call@std@@YAXXZ ?good@ios_base@std@@QEBA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Xlength_error@std@@YAXPEBD@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Xtime_get_ticks ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_counter ?_Random_device@std@@YAIXZ _Query_perf_frequency ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

crypt32

CryptDecodeObjectEx CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertAddCertificateContextToStore CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW

ws2_32

connect bind WSACleanup WSAStartup getpeername inet_ntop WSASetLastError ntohs getsockname inet_pton htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent recv setsockopt WSAEventSelect WSAEnumNetworkEvents WSACloseEvent send getsockopt sendto socket WSAIoctl gethostname ioctlsocket WSACreateEvent recvfrom __WSAFDIsSet freeaddrinfo getaddrinfo listen htonl accept select

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate strstr strrchr longjmp memcpy memmove memset memchr memcmp _CxxThrowException strchr wcschr __current_exception __current_exception_context __intrinsic_setjmp

api-ms-win-crt-stdio-l1-1-0

__p__commode fread _lseeki64 __stdio_common_vsscanf _wfopen fwrite ftell _wopen __stdio_common_vfprintf fseek feof fputs _set_fmode _read _write _fileno fclose _close fflush __acrt_iob_func ungetc setvbuf _popen _pclose _fseeki64 fsetpos fputc fgets fgetpos fgetc _get_stream_buffer_pointers __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-string-l1-1-0

strncpy _wcsdup strcspn tolower wcspbrk strcmp strspn _strdup strncmp wcsncmp strpbrk wcsncpy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free realloc calloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn exit system _errno __sys_errlist __sys_nerr abort _invalid_parameter_noinfo _resetstkoflw _beginthreadex terminate _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtoll atoi wcstombs strtoul strtod

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _localtime64_s _time64 _localtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlink remove _wstat64 _fstat64 _unlock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_dsign _dclass _fdopen sqrtf acosf ceilf cosf fmodf pow powf sinf __setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv