anticrack[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
anticrack.exe
Size 941KB
Sample261110-tpvdjsbx6x
SHA256 8f22872a46bcd02d387971b057747aa2822079ff1cfa0b250936e3faee8ee998
MD5 5038fd8cd09df817c3ff8c8cafb10bac
SHA1 ff5944de9009b03fe0b210cbc168114306d118c3
SHA512 2b3aa740a1dd6ddb09b4bacd091ef21ce8bfa34c6b77b58728db9b2de78e84bf930764ffb0c8ab09dc0ef352985e25a488928163de68e1eee9269277bb733029
SSDEEP 6144:rVZv69dtQJFJI6pFQhYbYLeUrtcExrKwAvYNjDDkdE6E:vYSJHkWScEP
TLSH
T149255466A6A665A4C17BC03CD542951EFD5034AA833862FFB2C54E802F917F8EF3D781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
anticrack.exe

File Explorer

anticrack.exe

.exe 941KB

anticrack.exe

IMPHASH ff0357233da55ad41c3ffeac92e8be51
SHA256 8f22872a46bcd02d387971b057747aa2822079ff1cfa0b250936e3faee8ee998
MD5 5038fd8cd09df817c3ff8c8cafb10bac
SHA1 ff5944de9009b03fe0b210cbc168114306d118c3
SHA512 2b3aa740a1dd6ddb09b4bacd091ef21ce8bfa34c6b77b58728db9b2de78e84bf930764ffb0c8ab09dc0ef352985e25a488928163de68e1eee9269277bb733029
SSDEEP 6144:rVZv69dtQJFJI6pFQhYbYLeUrtcExrKwAvYNjDDkdE6E:vYSJHkWScEP
TLSH
T149255466A6A665A4C17BC03CD542951EFD5034AA833862FFB2C54E802F917F8EF3D781
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

391980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Ali\source\repos\anticrack v2\x64\Debug\anticrack v2.pdb

kernel32

GetTickCount GetModuleHandleA GetProcAddress GetComputerNameA CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId MultiByteToWideChar RaiseException GetModuleHandleW GetCurrentProcess QueryPerformanceFrequency QueryPerformanceCounter CloseHandle CheckRemoteDebuggerPresent IsDebuggerPresent FindNextFileA FindFirstFileA GetStartupInfoW SetUnhandledExceptionFilter GetTickCount64 GetCurrentThreadId Sleep SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive WideCharToMultiByte FindClose FreeLibrary

user32

GetLastInputInfo EnumDisplaySettingsA GetWindow GetSystemMetrics GetWindowTextW GetTopWindow GetWindowTextLengthW MessageBoxA IsWindowVisible

advapi32

RegEnumValueA CheckTokenMembership RegQueryValueExA RegOpenKeyExA AllocateAndInitializeSid RegCloseKey FreeSid

msvcp140d

??1_Lockit@std@@QEAA@XZ ?_Random_device@std@@YAIXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ _Query_perf_frequency _Query_perf_counter ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z

iphlpapi

GetAdaptersAddresses

vcruntime140d

__vcrt_GetModuleHandleW __vcrt_LoadLibraryExW __vcrt_GetModuleFileNameW __std_type_info_destroy_list __C_specific_handler_noexcept __C_specific_handler __current_exception_context __current_exception memcmp memchr _CxxThrowException __std_exception_destroy __std_exception_copy memset memcpy memmove

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_crt_at_quick_exit __setusermatherr _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_fmode __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode strcpy_s strcat_s _wmakepath_s _wsplitpath_s _CrtDbgReportW _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _free_dbg malloc _callnewh terminate _rotl strlen __stdio_common_vsprintf_s _CrtDbgReport _calloc_dbg _dupenv_s free wcslen _seh_filter_exe wcscpy_s _cexit _set_app_type tolower

Name

.textbss

Size

Virtual Size

375KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

791KB

Virtual Size

790KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

673B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

anticrack.exe

kernel32

user32

advapi32

msvcp140d

iphlpapi

vcruntime140d

vcruntime140_1d

ucrtbased

generic