r2 | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

r2
Size

2.5MB
MD5

c4a44ec88e88d01e47686db31fc5f9a5
SHA1

36dbbe158a7011b2d87ed633fce7bc88f2b0e993
SHA256

4908807108ece32a951425e8cf63e272be098ead31095d927f09f5381cd22bcb
SHA512

36b932094607da13e8992cb0c17e23a5e075eec26bf97a68db230c78b5f99a409f305ba474fe0d81795bc352c11b2ba63b3eb5da061e60309c5c43adc32a30d7
SSDEEP

49152:XR7S/OC2j0vpEDBoAvNKMGIq7pOxyQGLRS6l1e4LgzxfKvZ3v7FrFY/s2NXqlB/A:XRGYMRJ/V0oK6DUKHPZS

Score

N/A

Malware Config

Signatures

Files

r2
.exe windows x86

be7a6c7245cc62652777c427fdb24506

Code Sign

34:99:10:fc:e9:8a:6b:9f:46:fb:58:1f:bb:20:ee:ca
Certificate

Issuer

CN=Eldon Tyrell,1.2.840.113549.1.9.1=#0c1c656c646f6e2e747972656c6c40747972656c6c2d636f72702e636f6d

Not Before

30-03-2022 08:15

Not After

30-03-2023 08:35

Subject

CN=Eldon Tyrell,1.2.840.113549.1.9.1=#0c1c656c646f6e2e747972656c6c40747972656c6c2d636f72702e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ad:40:72:fb:c7:42:e6:38:a4:9c:5e:4c:da:13:27:f2:1e:e1:d0:58:bd:ca:f1:a0:e6:08:66:0e:7b:d0:d5:e0
Signer

Actual PE Digest

ad:40:72:fb:c7:42:e6:38:a4:9c:5e:4c:da:13:27:f2:1e:e1:d0:58:bd:ca:f1:a0:e6:08:66:0e:7b:d0:d5:e0

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Eldon Tyrell,1.2.840.113549.1.9.1=#0c1c656c646f6e2e747972656c6c40747972656c6c2d636f72702e636f6d

30-06-2022 15:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_UP_SYSTEM_ONLY

Imports

kernel32

lstrlenW
SetErrorMode
GetModuleHandleW
OutputDebugStringA

user32

MessageBoxW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.11hix
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.cormet
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.gfids
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eh_fram
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.giats
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.debug$S
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.stab
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be7a6c7245cc62652777c427fdb24506

Code Sign

34:99:10:fc:e9:8a:6b:9f:46:fb:58:1f:bb:20:ee:caCertificate

Extended Key Usages

Key Usages

ad:40:72:fb:c7:42:e6:38:a4:9c:5e:4c:da:13:27:f2:1e:e1:d0:58:bd:ca:f1:a0:e6:08:66:0e:7b:d0:d5:e0Signer

Signature Validations

Verification

30-06-2022 15:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 43KB - Virtual size: 43KB

.edata Size: 11KB - Virtual size: 11KB

.data Size: 7KB - Virtual size: 7KB

.11hix Size: 50KB - Virtual size: 50KB

.reloc Size: 2KB - Virtual size: 1KB

.cormet Size: 27KB - Virtual size: 27KB

.gfids Size: 31KB - Virtual size: 31KB

.eh_fram Size: 3KB - Virtual size: 3KB

.giats Size: 20KB - Virtual size: 20KB

.debug$S Size: 74KB - Virtual size: 74KB

.sdata Size: 11KB - Virtual size: 11KB

.bss Size: 509KB - Virtual size: 509KB

.stab Size: 138KB - Virtual size: 138KB

34:99:10:fc:e9:8a:6b:9f:46:fb:58:1f:bb:20:ee:ca
Certificate

ad:40:72:fb:c7:42:e6:38:a4:9c:5e:4c:da:13:27:f2:1e:e1:d0:58:bd:ca:f1:a0:e6:08:66:0e:7b:d0:d5:e0
Signer

30-06-2022 15:34
Valid: false

.text
Size: 43KB - Virtual size: 43KB

.edata
Size: 11KB - Virtual size: 11KB

.data
Size: 7KB - Virtual size: 7KB

.11hix
Size: 50KB - Virtual size: 50KB

.reloc
Size: 2KB - Virtual size: 1KB

.cormet
Size: 27KB - Virtual size: 27KB

.gfids
Size: 31KB - Virtual size: 31KB

.eh_fram
Size: 3KB - Virtual size: 3KB

.giats
Size: 20KB - Virtual size: 20KB

.debug$S
Size: 74KB - Virtual size: 74KB

.sdata
Size: 11KB - Virtual size: 11KB

.bss
Size: 509KB - Virtual size: 509KB

.stab
Size: 138KB - Virtual size: 138KB