CrossFireWest[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CrossFireWest.exe
Size 3.4MB
Sample261110-yea95sae44
SHA256 d71ba08c0e4a150fa3c81b61b6005f2ba8c52c32108d0e0fdc3d1915d460435a
MD5 fbfbe0c96a7d2a85aafcece404307243
SHA1 8b9192a038823298ae6e0e48bbdc3ae0e5936b99
SHA512 979a2cfc53da55884237c620e0201f14d97b487f6b1ab2e027143dd3be2503ffa317f3cdd1bfc3786407a7983aa07513a5776902da219b87ac49eb76460adea8
SSDEEP 98304:qGUXXPvOiyg82ontlpgPQzLR98vopW8jC:qGUvvTyg82onb79LjC
TLSH
T160F5CF02B8439471D1511035D10CB72E4B7D57B207198CE7E3CE2D8BABFA9E2A93AB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

CrossFireWest.exe

.exe 3.4MB

CrossFireWest.exe

IMPHASH 66667c267abe0bf6ab37bb43b01f4d42
SHA256 d71ba08c0e4a150fa3c81b61b6005f2ba8c52c32108d0e0fdc3d1915d460435a
MD5 fbfbe0c96a7d2a85aafcece404307243
SHA1 8b9192a038823298ae6e0e48bbdc3ae0e5936b99
SHA512 979a2cfc53da55884237c620e0201f14d97b487f6b1ab2e027143dd3be2503ffa317f3cdd1bfc3786407a7983aa07513a5776902da219b87ac49eb76460adea8
SSDEEP 98304:qGUXXPvOiyg82ontlpgPQzLR98vopW8jC:qGUvvTyg82onb79LjC
TLSH
T160F5CF02B8439471D1511035D10CB72E4B7D57B207198CE7E3CE2D8BABFA9E2A93AB57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

ea:26:f2:78:a6:c2:48:40:ec:35:88:9b:68:ee:85:81:cf:88:62:6c:c0:02:92:36:94:5a:3e:03:c9:65:77:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Solid State Networks I\, LLC,O=Solid State Networks I\, LLC,L=Phoenix,ST=Arizona,C=US

Chains

Dec 16, 2025

CN=Solid State Networks I\, LLC,O=Solid State Networks I\, LLC,L=Phoenix,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Solid State Networks I\, LLC,O=Solid State Networks I\, LLC,L=Phoenix,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

46:ad:c9:bc:e4:78:23:31:10:7c:64:58:00:9e:3b:d6:12:3a:b5:84

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Solid State Networks I\, LLC,O=Solid State Networks I\, LLC,L=Phoenix,ST=Arizona,C=US

Chains

Dec 16, 2025

CN=Solid State Networks I\, LLC,O=Solid State Networks I\, LLC,L=Phoenix,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Solid State Networks I\, LLC,O=Solid State Networks I\, LLC,L=Phoenix,ST=Arizona,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Solid State Networks I\, LLC,O=Solid State Networks I\, LLC,L=Phoenix,ST=Arizona,C=US

Serial Number

08:e2:39:f5:6f:42:c7:92:8a:4d:ed:5e:66:9d:46:7e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 16, 2023 - Jan 24, 2026

Minor OS version

Major OS version

Entry point

1467773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\actions-runner\_work\client\client\host\build\MinSizeRel\host.pdb

dbghelp

SymSetOptions SymGetLineFromAddr64 SymFromAddr SymSetSearchPathW SymGetSearchPathW SymInitialize SymCleanup

version

VerQueryValueW VerQueryValueA GetFileVersionInfoExW GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW

winhttp

WinHttpSetStatusCallback WinHttpOpen WinHttpCloseHandle WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser

kernel32

CreateThread IsBadReadPtr FlushInstructionCache HeapSize WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW GetTimeZoneInformation ReadConsoleW FreeLibraryAndExitThread ExitThread SetStdHandle GetConsoleMode GetConsoleOutputCP GetCurrentProcess TerminateProcess GetModuleHandleW GlobalAlloc GlobalFree CompareStringW DeleteFileW GetLastError SetEnvironmentVariableW VerSetConditionMask GetCommandLineW VerifyVersionInfoW GetFileAttributesW GetModuleFileNameW OutputDebugStringA OutputDebugStringW GetProcAddress LoadLibraryExW LoadLibraryW FreeLibrary GetEnvironmentVariableW GetStdHandle CreateFileA CreateFileW QueryDosDeviceW WriteFile IsDebuggerPresent CloseHandle HeapAlloc HeapFree GetProcessHeap DeviceIoControl WaitForSingleObject GetExitCodeProcess CreateProcessW GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GlobalMemoryStatusEx GetSystemDirectoryW GetWindowsDirectoryW CreateFileMappingW MapViewOfFile FreeResource GetModuleHandleA LoadResource LockResource SizeofResource FindResourceW LocalAlloc LocalFree SetThreadExecutionState MoveFileWithProgressW AllocConsole FreeConsole SetConsoleCtrlHandler SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceW GetFileAttributesExW GetLongPathNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW RaiseException GetOverlappedResult Sleep GetCurrentProcessId GetCurrentThread GetCurrentThreadId SetThreadPriority GetNativeSystemInfo VirtualQuery UnmapViewOfFile FormatMessageA CopyFileExW MoveFileExW FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx GetLocaleInfoEx ReadFile SetFilePointerEx CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus MulDiv IsProcessorFeaturePresent GetTickCount64 InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlushFileBuffers SetHandleInformation CreatePipe ConnectNamedPipe DisconnectNamedPipe PeekNamedPipe CreateNamedPipeW WaitNamedPipeW SetLastError SetEvent ResetEvent CreateEventW ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW RtlCaptureContext SetUnhandledExceptionFilter TerminateThread VirtualQueryEx DuplicateHandle SetNamedPipeHandleState TransactNamedPipe WaitForMultipleObjects HeapSetInformation SetProcessDEPPolicy VirtualAllocEx UnregisterWait RegisterWaitForSingleObject TerminateJobObject GetModuleHandleExW SetInformationJobObject GetUserDefaultLangID GetUserDefaultLCID GetUserDefaultLocaleName EnumSystemLocalesEx HeapDestroy GetTickCount GetVersionExW GetProductInfo IsWow64Process TryAcquireSRWLockExclusive ReleaseSRWLockExclusive UnregisterWaitEx GetThreadId GetThreadPriority GetFileType AssignProcessToJobObject WriteProcessMemory ReadProcessMemory GetCurrentProcessorNumber SetThreadAffinityMask VirtualFree GetProcessHeaps ExpandEnvironmentStringsW AcquireSRWLockExclusive GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter GetLocalTime CreateJobObjectW QueryInformationJobObject VirtualProtectEx CreateMutexW VirtualFreeEx GetProcessHandleCount TlsGetValue lstrlenW DebugBreak GetFileSizeEx FindFirstFileExW TlsAlloc TlsFree TlsSetValue RtlCaptureStackBackTrace CreateRemoteThread GetSystemInfo WideCharToMultiByte MultiByteToWideChar ExitProcess VirtualProtect LoadLibraryExA UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx GetStartupInfoW InitializeSListHead InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

CrossFireWest.exe

dbghelp

version

winhttp

kernel32

generic