ophcrack-3[.]8[.]0-bin[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
ophcrack-3.8.0-bin.zip
Size 15.1MB
Sample261113-pgalysbx5q
SHA256 36a35b2f84fe4ebc4652776abb55256f371998d8044253d062858e7ed77545db
MD5 e8cb96786f5180a796465d73c5189495
SHA1 f7975e274bc4344080cab23408f78e9ad659e857
SHA512 df29fd423b296af5bce7ae3f8eeffdc5600ac8fe49a48d90f93630efe7e60af4d6e1b6206c46914d1e3b4124f64b648e65c6b27fb9581c916e6a38545856aa43
SSDEEP 393216:sZmNVLovxEiFTaUsUhhWTis1DDXXvhFC0fB2B03WTl:7NzyTa2hhWWWbzzAa3WTl
TLSH
T1F0F633C8F2A30B2ADC19D462A43AD51643DEE0D979C2426DDBD1EF440CBECB56C1ADD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/x64/ophcrack.exe
unpack001/x64/ophcrack_nogui.exe
unpack001/x86/ophcrack.exe
unpack001/x86/ophcrack_nogui.exe

File Explorer

ophcrack-3.8.0-bin.zip

.zip 15.1MB
x64/ophcrack.exe

.exe 15.5MB
x64/ophcrack_nogui.exe

.exe 1.9MB
x86/ophcrack.exe

.exe 14.7MB
x86/ophcrack_nogui.exe

.exe 1.5MB

ophcrack-3.8.0-bin.zip

SHA256 36a35b2f84fe4ebc4652776abb55256f371998d8044253d062858e7ed77545db
MD5 e8cb96786f5180a796465d73c5189495
SHA1 f7975e274bc4344080cab23408f78e9ad659e857
SHA512 df29fd423b296af5bce7ae3f8eeffdc5600ac8fe49a48d90f93630efe7e60af4d6e1b6206c46914d1e3b4124f64b648e65c6b27fb9581c916e6a38545856aa43
SSDEEP 393216:sZmNVLovxEiFTaUsUhhWTis1DDXXvhFC0fB2B03WTl:7NzyTa2hhWWWbzzAa3WTl
TLSH
T1F0F633C8F2A30B2ADC19D462A43AD51643DEE0D979C2426DDBD1EF440CBECB56C1ADD8
MD5 SHA1 SHA512 SSDEEP TLSH

x64/ophcrack.exe

IMPHASH 2f74404781d0ded5a9bfff51af0b6924
SHA256 95e73a3d5e88f79e2c3bf6e146a389e90ec91c5c56ac8dd381bb9e45164c7243
MD5 a2a8da835c7341b606f10805fba26687
SHA1 6b55ce3ffd18e949dc1210f310a02a74d452c687
SHA512 8ebd695af09161b2eac680393018edd1b42310ccc8ca7e2fa88ec933b3db82e7997bb6d65d41c78905941303042180170d957811527cd3db629e8ab140c94ead
SSDEEP 393216:Y3AKPF1arrr3Jsv6tWKFdu9CsgQj3JrwplPvZ:mAK91+
TLSH
T119F65A57F2A350ECC16BC13443ABA772B93178681534BE6F2654DB392F21F605B2B728
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CopySid DeregisterEventSource FreeSid GetLengthSid GetTokenInformation LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyA RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

dwmapi

DwmEnableBlurBehindWindow DwmIsCompositionEnabled

gdi32

AddFontMemResourceEx AddFontResourceExW BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateRectRgn DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesExW ExtTextOutW GdiFlush GetBitmapBits GetCharABCWidthsFloatW GetCharABCWidthsW GetDIBits GetDeviceCaps GetFontData GetGlyphOutlineW GetObjectW GetOutlineTextMetricsW GetPixelFormat GetRegionData GetStockObject GetTextExtentPoint32W GetTextFaceW GetTextMetricsW OffsetRgn RemoveFontMemResourceEx RemoveFontResourceExW SelectClipRgn SelectObject SetBkMode SetGraphicsMode SetPixelFormat SetTextAlign SetTextColor SetWorldTransform SwapBuffers

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmGetVirtualKey ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

kernel32

AddVectoredExceptionHandler CheckRemoteDebuggerPresent CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageW FreeLibrary GetCommandLineW GetConsoleWindow GetCurrencyFormatW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileType GetFullPathNameW GetGeoInfoW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserGeoID GetUserPreferredUILanguages GetVersion GetVolumeInformationA GetVolumeInformationW GetVolumePathNamesForVolumeNameW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlUnwindEx SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW

msvcrt

___lc_codepage_func __argc __argv __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _close _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _getdrive _gmtime64 _initterm _localtime64 _lock _lseeki64 _mktime64 _onexit _open_osfhandle _read _setmode _snwprintf _strdup _strnicmp _time64 _tzset _unlock _waccess _wchmod _wfopen _wgetdcwd _write abort acos asin atan atof bsearch calloc exit fclose feof ferror fflush fgetc fgetpos fgets fopen fprintf fputc fputs fread free frexp fseek fsetpos ftell fwprintf fwrite getc getenv iswctype localeconv log10 malloc perror printf putchar puts raise rand realloc remove rewind setlocale signal srand strcat strcoll strerror strftime strrchr strstr strtok strtol strxfrm tan towlower towupper ungetc vfprintf wcscmp wcscoll wcscpy wcsftime wcslen wcsncmp wcsrchr wcsxfrm _tzname _timezone _write _strdup _setmode _putenv _open _fileno _fdopen _close _access

ntdll

NtFsControlFile NtOpenFile RtlAddFunctionTable RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind __C_specific_handler _setjmp _stricmp _ultoa _vsnprintf _vsnwprintf atoi ceil floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit longjmp mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncmp strncpy strtoul tolower toupper wcsstr

ole32

CoCreateGuid CoCreateInstance CoGetMalloc CoInitialize CoLockObjectExternal CoTaskMemFree CoUninitialize DoDragDrop OleFlushClipboard OleGetClipboard OleInitialize OleIsCurrentClipboard OleSetClipboard OleUninitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop StringFromGUID2

oleaut32

SysAllocStringLen VariantInit

opengl32

glLoadIdentity glLoadMatrixf glMatrixMode glOrtho

shell32

CommandLineToArgvW SHBrowseForFolderW SHCreateItemFromIDList SHCreateItemFromParsingName SHGetFileInfoW SHGetKnownFolderIDList SHGetKnownFolderPath SHGetMalloc SHGetPathFromIDListW SHGetStockIconInfo ShellExecuteW

user32

AdjustWindowRectEx AttachThreadInput BeginPaint CallNextHookEx ChangeClipboardChain CharNextExA ChildWindowFromPointEx ClientToScreen CreateCaret CreateCursor CreateIconIndirect CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyWindow DispatchMessageW DrawIconEx EnableMenuItem EndPaint EnumDisplayMonitors EnumWindows FlashWindowEx GetAncestor GetAsyncKeyState GetCapture GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursor GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenu GetMessageExtraInfo GetMonitorInfoW GetParent GetProcessWindowStation GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetUpdateRect GetUserObjectInformationW GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId HideCaret InvalidateRect IsChild IsHungAppWindow IsIconic IsWindow IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MessageBeep MessageBoxW MoveWindow MsgWaitForMultipleObjectsEx NotifyWinEvent PeekMessageW PostMessageW RealGetWindowClassW RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetCaretPos SetClipboardViewer SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetMenuItemInfoW SetParent SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToAscii ToUnicode TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateLayeredWindow UpdateLayeredWindowIndirect

uxtheme

CloseThemeData DrawThemeBackgroundEx GetCurrentThemeName GetThemeBackgroundRegion GetThemeBool GetThemeColor GetThemeEnumValue GetThemeInt GetThemeMargins GetThemePartSize GetThemePropertyOrigin GetThemeTransitionDuration IsAppThemed IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeData SetWindowTheme

winmm

PlaySoundW timeKillEvent timeSetEvent

ws2_32

WSAAsyncSelect WSACleanup WSAStartup gethostname

wsock32

htons

Name

.text

Size

11.0MB

Virtual Size

11.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

435KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

513KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

x64/ophcrack_nogui.exe

IMPHASH 49dd3e94cf777dbe377bf4c003470b6e
SHA256 23712078e2678f213bd8ba79b2892d4ab8c26ab1b385bbc2c12b84d051b99bf6
MD5 0e1311b71d9232febba3a8f198180b9d
SHA1 c51bafb5ff4ac94967fa481585ff0e6446e52802
SHA512 605b6e64c57ffa50b0fc9e6989907f687effeaa0cd5061fb67284d3f8c20c8111595cd6dd5f7c2a98b5ef5d53b42a35458a48a79f24609f4c07c896936b75973
SSDEEP 24576:ofniqB3WTiRedKNy0zGxbwsic9x3THDUj7yQ7lx648j7Tu+k2datMJGYI2:gsTiRedASpFclx6Pr62dayJGYI2
TLSH
T1B8955B5FF7C1CDDFCA16827449EB4339273AF4502347EB57290892386D5FAA0AF86618
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegisterEventSourceW ReportEventW

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FlushViewOfFile GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileSize GetFileType GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVolumeInformationA GlobalMemoryStatusEx HeapAlloc HeapFree InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection MapViewOfFile MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WriteFile

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _initterm _localtime64 _lock _lseeki64 _onexit _setmode _snwprintf _time64 _unlock _wfopen _write abort calloc exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos ftell fwprintf fwrite getenv malloc perror printf putchar puts raise realloc rewind signal strerror strncmp strtok vfprintf wcscpy _strdup _open _fileno _close _access

ntdll

NtFsControlFile NtOpenFile RtlInitUnicodeString RtlNtStatusToDosError RtlVirtualUnwind __C_specific_handler _setjmp _stricmp _ultoa _vsnprintf _vsnwprintf atoi floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit longjmp mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncpy strtoul tolower toupper wcsstr

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

wsock32

htons

Name

.text

Size

374KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

469KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

540KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/ophcrack.exe

IMPHASH 35fc3921c963134107247ba35c6cc900
SHA256 873c6cafc53f1a461bb948aadd6d03a0c48709180aef356445024154bf4111c0
MD5 d8d03eebaed1a346d9a1033612f354cc
SHA1 2f58c3f85abe7eccb5076ecf50498b279ab3d5f5
SHA512 028e6244634753261986b52c2aeaf20325ec63ed8919ad8306e8c68d94afe66d9a8672ab8417dc13456e26f32257ae1ce39cce4ec06acdb06b7ccd4455d6094e
SSDEEP 393216:jxQx3roSiRvUP8BaM/viJsv6tWKFdu9C:+x0RA8n
TLSH
T195F66D59EA4390F4DE5305F15547FBFF56301B218838CCABE698AE4CEE73A62140B726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

dwmapi

DwmEnableBlurBehindWindow DwmIsCompositionEnabled

gdi32

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmGetVirtualKey ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

kernel32

AddVectoredExceptionHandler CheckRemoteDebuggerPresent CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageW FreeLibrary GetCommandLineW GetConsoleWindow GetCurrencyFormatW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileType GetFullPathNameW GetGeoInfoW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount64 GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserGeoID GetUserPreferredUILanguages GetVersion GetVolumeInformationA GetVolumeInformationW GetVolumePathNamesForVolumeNameW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW

msvcrt

__argc __argv __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _close _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstati64 _get_osfhandle _getdrive _initterm _iob _lock _lseeki64 _onexit _open_osfhandle _read _setjmp3 _setmode _snwprintf _strdup _strnicmp time mktime localtime gmtime exit fclose feof ferror fflush fgetc fgetpos fgets fopen fprintf fputc fputs fread free frexp fseek fsetpos ftell fwprintf fwrite getc getenv iswctype localeconv log10 malloc perror printf putchar puts raise rand realloc remove rewind setlocale signal srand strcat strcoll strerror strftime strrchr strstr strtok strtol strxfrm _tzset _unlock _waccess _wchmod _wfopen _wgetdcwd _write abort acos asin atan atof tan towlower towupper ungetc vfprintf wcscmp wcscoll wcscpy wcsftime wcslen wcsncmp wcsrchr wcsxfrm bsearch calloc longjmp _tzname _timezone _write _strdup _setmode _putenv _open _fileno _fdopen _close _access

ntdll

NtFsControlFile NtOpenFile RtlInitUnicodeString RtlNtStatusToDosError _stricmp _ultoa _vsnprintf atoi ceil floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncmp strncpy strtoul tolower toupper wcsstr

ole32

oleaut32

SysAllocStringLen VariantInit

opengl32

glLoadIdentity glLoadMatrixf glMatrixMode glOrtho

shell32

user32

AdjustWindowRectEx AttachThreadInput BeginPaint CallNextHookEx ChangeClipboardChain CharNextExA ChildWindowFromPointEx ClientToScreen CreateCaret CreateCursor CreateIconIndirect CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyWindow DispatchMessageW DrawIconEx EnableMenuItem EndPaint EnumDisplayMonitors EnumWindows FlashWindowEx GetAncestor GetAsyncKeyState GetCapture GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursor GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenu GetMessageExtraInfo GetMonitorInfoW GetParent GetProcessWindowStation GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetUpdateRect GetUserObjectInformationW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId HideCaret InvalidateRect IsChild IsHungAppWindow IsIconic IsWindow IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MessageBeep MessageBoxA MessageBoxW MoveWindow MsgWaitForMultipleObjectsEx NotifyWinEvent PeekMessageW PostMessageW RealGetWindowClassW RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetCaretPos SetClipboardViewer SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetMenuItemInfoW SetParent SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToAscii ToUnicode TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateLayeredWindow UpdateLayeredWindowIndirect

uxtheme

winmm

PlaySoundW timeKillEvent timeSetEvent

ws2_32

WSAAsyncSelect WSACleanup WSAStartup gethostname

wsock32

htons

Name

.text

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

x86/ophcrack_nogui.exe

IMPHASH bc6af91bae6902a88acba7780f85b510
SHA256 a8cb5f18549c05586c473b5dc133b63a21f85a005c817a1a69cb4731574edc22
MD5 0ddf42239ae936368b7bb86400ac4689
SHA1 b46303b019ff9b4a88527a5c07972cf75503c653
SHA512 b79b2450abb9d0e259faaca07d0a262392eeb00eee5a6c4137fdd2f5cb5149f450efdbde65bdee9e0d9438fa43f6a1daca9722372b7f636522a27aa03c20d627
SSDEEP 24576:B3c5tbs08PZCvCbBZE3c5q0dCGTPIPLn+Tvv+i9rioXsDtejF1S8:R08hpIPLn+NBjF1f
TLSH
T177759D9DFFC68DA7DE12067689F6933B073AC6506253DBE3D708D538AC173522E8A604
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueA OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegisterEventSourceA ReportEventA

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FlushViewOfFile GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileSize GetFileType GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVolumeInformationA GlobalMemoryStatusEx HeapAlloc HeapFree InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection MapViewOfFile MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread SetEvent SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WriteFile

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstati64 _get_osfhandle _initterm _iob _lock _lseeki64 _onexit _setjmp3 _setmode _snwprintf time localtime exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos ftell fwprintf fwrite getenv malloc perror printf putchar puts raise realloc rewind signal strerror strncmp strtok _unlock _wfopen _write abort vfprintf wcscpy calloc longjmp _strdup _open _fileno _close _access

ntdll

NtFsControlFile NtOpenFile RtlInitUnicodeString RtlNtStatusToDosError _stricmp _ultoa _vsnprintf atoi floor isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit mbstowcs memchr memcmp memcpy memmove memset pow qsort sprintf sqrt sscanf strchr strcmp strcpy strlen strncpy strtoul tolower toupper wcsstr

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA MessageBoxW

wsock32

htons

Name

.text

Size

374KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

440KB

Virtual Size

439KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ophcrack-3.8.0-bin.zip

x64/ophcrack.exe

advapi32

dwmapi

gdi32

imm32

kernel32

msvcrt

ntdll

ole32

oleaut32

opengl32

shell32

user32

uxtheme

winmm

ws2_32

wsock32

generic

x64/ophcrack_nogui.exe

advapi32

kernel32

msvcrt

ntdll

user32

wsock32

generic

x86/ophcrack.exe

advapi32

dwmapi

gdi32

imm32

kernel32

msvcrt

ntdll

ole32

oleaut32

opengl32

shell32

user32

uxtheme

winmm

ws2_32

wsock32

generic

x86/ophcrack_nogui.exe

advapi32

kernel32

msvcrt

ntdll

user32

wsock32

generic