temps_crack[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
temps_crack.exe
Size 67.8MB
Sample261113-vtedkayv9k
SHA256 9763ce9d32c2253e815c2fe70f4c77ea48526456a17f3ab61fe54fc9d308ef77
MD5 b8eb617757795b74e2037b83c6f145b4
SHA1 0e928e287a2d303072f15428e54d658735cf0073
SHA512 f33d869a73545f5ee1a58d7a6ab170509c9f92ff59d38246034a5a74123a7716a40d6ce31d5947998dc7ca68bcffd57e11fa973defda38dde81096e5c055d252
SSDEEP 786432:A0B7QwUgEmPZfo+WMz4Ql/9natOKsfLF:A0B7BUgEmPZfo+WMz4Ql1n
TLSH
T103F7634C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
temps_crack.exe

File Explorer

temps_crack.exe

.exe 67.8MB

temps_crack.exe

IMPHASH bd8f4b485da1e3e003fa5b344ff25a07
SHA256 9763ce9d32c2253e815c2fe70f4c77ea48526456a17f3ab61fe54fc9d308ef77
MD5 b8eb617757795b74e2037b83c6f145b4
SHA1 0e928e287a2d303072f15428e54d658735cf0073
SHA512 f33d869a73545f5ee1a58d7a6ab170509c9f92ff59d38246034a5a74123a7716a40d6ce31d5947998dc7ca68bcffd57e11fa973defda38dde81096e5c055d252
SSDEEP 786432:A0B7QwUgEmPZfo+WMz4Ql/9natOKsfLF:A0B7BUgEmPZfo+WMz4Ql1n
TLSH
T103F7634C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56849456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\denis\source\repos\temportaty loader\builds\temp_loader.pdb

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest

kernel32

GetLocaleInfoEx GetThreadContext FormatMessageA GetStdHandle CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx WriteFile GetTempPathW CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject Sleep ExitProcess GetExitCodeProcess CreateProcessW GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW MoveFileExW MultiByteToWideChar GetConsoleMode SetConsoleMode SetConsoleTitleW WriteConsoleW SetConsoleCtrlHandler GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage InitializeCriticalSectionEx DeleteCriticalSection DecodePointer GetCurrentProcess LocalFree K32GetModuleInformation AddVectoredExceptionHandler LoadLibraryA RaiseException GetProcessHeap HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize DuplicateHandle GetModuleHandleA GetProcAddress GetSystemInfo IsWow64Process VirtualFreeEx GetSystemDirectoryA CreateFileA SetFilePointer VirtualAllocEx GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent RtlUnwind RemoveVectoredExceptionHandler VirtualAlloc VirtualFree VirtualQuery VirtualProtect GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW OutputDebugStringW EnterCriticalSection LeaveCriticalSection RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer GetConsoleCP RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread IsThreadAFiber LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP WideCharToMultiByte GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW FindFirstFileExW

shlwapi

ord215

userenv

UnloadUserProfile

ntdll

NtMapViewOfSection NtCreateSection NtUnmapViewOfSection NtClose RtlImageNtHeader

user32

UnregisterClassA

advapi32

GetLengthSid ConvertSidToStringSidA OpenThreadToken GetTokenInformation LookupAccountSidA CopySid OpenProcessToken IsValidSid

Name

.text

Size

54.7MB

Virtual Size

54.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

temps_crack.exe

winhttp

kernel32

shlwapi

userenv

ntdll

user32

advapi32

generic