r2 | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

r2
Size

1.7MB
MD5

45ba531461eb20bd25e4e98e6aaec8cc
SHA1

1e99e26a71c84a174c10d0ac91bad5255b1b1231
SHA256

7c4e30d64e59979f15537ba33e37f0114634867e5d48330f6045f9894a1d4a60
SHA512

d37f69cf5666e7c17cb984ad1b7e86b246b9410297b0a73dead5b647edc096a53b548c5365caba62b2f761f2c67383db6ae765f7cb5fa71c11fdf9bc757d7d8c
SSDEEP

49152:iRQ1vjRsBoQQJyFfH7VbMGKfnKyhhI8xlIV+9pjbN4ebpJHurg+ez4Y5HY7OLlJl:iR8A6kA4ipJJUkAqx

Score

N/A

Malware Config

Signatures

Files

r2
.exe windows x86

be7a6c7245cc62652777c427fdb24506

Code Sign

34:99:10:fc:e9:8a:6b:9f:46:fb:58:1f:bb:20:ee:ca
Certificate

Issuer

CN=Eldon Tyrell,1.2.840.113549.1.9.1=#0c1c656c646f6e2e747972656c6c40747972656c6c2d636f72702e636f6d

Not Before

30-03-2022 08:15

Not After

30-03-2023 08:35

Subject

CN=Eldon Tyrell,1.2.840.113549.1.9.1=#0c1c656c646f6e2e747972656c6c40747972656c6c2d636f72702e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

76:45:16:23:38:bd:b1:e7:7d:71:d1:80:04:be:b3:d8:6d:d4:94:45:4d:07:57:32:d1:7b:21:54:52:3f:18:06
Signer

Actual PE Digest

76:45:16:23:38:bd:b1:e7:7d:71:d1:80:04:be:b3:d8:6d:d4:94:45:4d:07:57:32:d1:7b:21:54:52:3f:18:06

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Eldon Tyrell,1.2.840.113549.1.9.1=#0c1c656c646f6e2e747972656c6c40747972656c6c2d636f72702e636f6d

30-06-2022 15:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_SYSTEM
IMAGE_FILE_UP_SYSTEM_ONLY

Imports

kernel32

lstrlenW
SetErrorMode
GetModuleHandleW
OutputDebugStringA

user32

MessageBoxW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.11hix
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sxdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.debug$P
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.glue_7
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vsdata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.drectv
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 522KB - Virtual size: 522KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.minAT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bootdat
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be7a6c7245cc62652777c427fdb24506

Code Sign

34:99:10:fc:e9:8a:6b:9f:46:fb:58:1f:bb:20:ee:caCertificate

Extended Key Usages

Key Usages

76:45:16:23:38:bd:b1:e7:7d:71:d1:80:04:be:b3:d8:6d:d4:94:45:4d:07:57:32:d1:7b:21:54:52:3f:18:06Signer

Signature Validations

Verification

30-06-2022 15:35 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 11KB - Virtual size: 11KB

.tls Size: 7KB - Virtual size: 7KB

.11hix Size: 50KB - Virtual size: 50KB

.reloc Size: 2KB - Virtual size: 1KB

.sxdata Size: 4KB - Virtual size: 4KB

.debug$P Size: 39KB - Virtual size: 39KB

.glue_7 Size: 4KB - Virtual size: 4KB

.vsdata Size: 74KB - Virtual size: 74KB

.drectv Size: 124KB - Virtual size: 124KB

.wpp_sf Size: 522KB - Virtual size: 522KB

.minAT Size: 5KB - Virtual size: 5KB

.bootdat Size: 94KB - Virtual size: 94KB

34:99:10:fc:e9:8a:6b:9f:46:fb:58:1f:bb:20:ee:ca
Certificate

76:45:16:23:38:bd:b1:e7:7d:71:d1:80:04:be:b3:d8:6d:d4:94:45:4d:07:57:32:d1:7b:21:54:52:3f:18:06
Signer

30-06-2022 15:35
Valid: false

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 11KB - Virtual size: 11KB

.tls
Size: 7KB - Virtual size: 7KB

.11hix
Size: 50KB - Virtual size: 50KB

.reloc
Size: 2KB - Virtual size: 1KB

.sxdata
Size: 4KB - Virtual size: 4KB

.debug$P
Size: 39KB - Virtual size: 39KB

.glue_7
Size: 4KB - Virtual size: 4KB

.vsdata
Size: 74KB - Virtual size: 74KB

.drectv
Size: 124KB - Virtual size: 124KB

.wpp_sf
Size: 522KB - Virtual size: 522KB

.minAT
Size: 5KB - Virtual size: 5KB

.bootdat
Size: 94KB - Virtual size: 94KB