saryx internal cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
saryx internal cracked.exe
Size 829KB
Sample261109-drdktawvex
SHA256 57a38896366ab26e8fc8c1a918327a7ddd1706827fcfdb2bc302ab1537754d26
MD5 18a54c4d6f87affed671c3eca51d7916
SHA1 9207ea55c31d055eb33c6ed5e78a43e752744c0e
SHA512 17a6f2b620eb62dd595c1fb8c508d58e7e75ff456e6c6642f32c2a47bbd7edadbe1a581589aef5d33e4375054b63014c90e4c001209899589b0294a8eccfe335
SSDEEP 12288:iJx8qDIhJaA+KndKbo1gJC4bBJP4tVbHaoKy:iJWqM3aAZndKboT4bLP4/bHx
TLSH
T1B0059E19B5A500FAD176E479C9932917FA32B84507209ADB03E09ABB1F737E0677FB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
saryx internal cracked.exe

File Explorer

saryx internal cracked.exe

.exe 829KB

saryx internal cracked.exe

IMPHASH bd377d9ce8e1b234f8c52f27d631e713
SHA256 57a38896366ab26e8fc8c1a918327a7ddd1706827fcfdb2bc302ab1537754d26
MD5 18a54c4d6f87affed671c3eca51d7916
SHA1 9207ea55c31d055eb33c6ed5e78a43e752744c0e
SHA512 17a6f2b620eb62dd595c1fb8c508d58e7e75ff456e6c6642f32c2a47bbd7edadbe1a581589aef5d33e4375054b63014c90e4c001209899589b0294a8eccfe335
SSDEEP 12288:iJx8qDIhJaA+KndKbo1gJC4bBJP4tVbHaoKy:iJWqM3aAZndKboT4bLP4/bHx
TLSH
T1B0059E19B5A500FAD176E479C9932917FA32B84507209ADB03E09ABB1F737E0677FB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\x\Desktop\Fortnite Internal\fortnite injector\fortnite injector\fortnite injector\x64\Release\injector.pdb

kernel32

SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetConsoleMode GetTempPathA GetLastError Process32NextW K32GetModuleBaseNameW MoveFileExA DeleteFileA DeleteFileW Process32FirstW CloseHandle LocalFree MoveFileExW OpenProcess GetCurrentProcessId WideCharToMultiByte GetConsoleWindow CreateProcessA K32EnumProcessModules FormatMessageA AllocConsole SetConsoleTitleW GetComputerNameA AcquireSRWLockExclusive GetFileInformationByHandleEx GetFileAttributesW CreateFileW WaitForSingleObject GetVolumeInformationA GetTempPathW RemoveDirectoryW TerminateProcess SetConsoleMode WriteFile GetStdHandle GetCurrentProcess GetConsoleScreenBufferInfo ReadFile GetSystemFirmwareTable GetComputerNameW CreateDirectoryW AreFileApisANSI WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsProcessorFeaturePresent GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle ReleaseSRWLockExclusive CreateFile2

user32

ShowWindow SetLayeredWindowAttributes SetWindowLongPtrW SetWindowPos GetWindowLongPtrW

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegDeleteKeyW AllocateAndInitializeSid SetEntriesInAclW RegCreateKeyExW SetNamedSecurityInfoW RegDeleteTreeW RegSetValueExW OpenProcessToken FreeSid CheckTokenMembership RegOpenKeyExW RegQueryValueExW

shell32

SHCreateDirectoryExW

msvcp140

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Xtime_get_ticks ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

wininet

InternetReadFile HttpAddRequestHeadersA InternetCloseHandle InternetConnectA InternetOpenA HttpSendRequestA HttpQueryInfoA HttpOpenRequestA InternetSetOptionA

bcrypt

BCryptDestroyKey BCryptVerifySignature BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptEncrypt

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memcpy memset __current_exception_context __current_exception __C_specific_handler __std_terminate __std_exception_destroy _CxxThrowException __std_exception_copy memmove

api-ms-win-crt-stdio-l1-1-0

fread ungetc fclose __p__commode _set_fmode _get_stream_buffer_pointers freopen_s setvbuf fputc __acrt_iob_func fgetpos fsetpos fflush fopen_s __stdio_common_vsprintf_s fgetc fgets fwrite _fseeki64

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-string-l1-1-0

strlen _wcsicmp wcslen _stricmp

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-convert-l1-1-0

atoi atof atoll strtoul

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_atexit _initterm _initterm_e exit _exit _cexit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table terminate _initialize_narrow_environment _configure_narrow_argv abort _get_initial_narrow_environment

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func