rebornloader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

rebornloader.exe
Size

3.2MB
MD5

20c301a092a0058010db2a37445df163
SHA1

08ace1db403e14dcef7665507fc07e8e42016111
SHA256

d1425d5ef792263c7a3f890e240e5cb7f5241f5894e6504131419125c70240bf
SHA512

c3aa5af1a90670bffa4d7f06cb8be523477adc16ab1c62c44e0746442a6764262c10312bc1b25428712c5eb937aa65ba06e4085a40aeb14a34fa076d9a1da1a0
SSDEEP

49152:35x03N4q3/A6Nall7YZ0YK8xGS8XputJ9K1tlRYfuPM58yMIjAld/gA0:/96NallKoXAP9gRdE5HMIod/

Score

1^/10

Malware Config

Signatures

Files

rebornloader.exe
.exe windows x86

fd7b76008cbbd7fcc9a725e53b83b369

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileA
Process32First
WriteProcessMemory
VirtualAlloc
TerminateProcess
Module32Next
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Sleep
CreateFileA
DeleteFileA
Process32Next
CloseHandle
VirtualAllocEx
GetFileSize
CreateRemoteThread
CreateDirectoryA
GetProcAddress
QueryPerformanceFrequency
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleFileNameA
GetCurrentProcessId
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
ReadFile
QueryPerformanceCounter
FreeLibrary
GetCurrentThreadId
GlobalAlloc
VirtualFreeEx
MultiByteToWideChar

user32

DestroyWindow
GetWindowRect
DispatchMessageA
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetCapture
ClientToScreen
TrackMouseEvent
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
GetWindowLongA
MoveWindow
DefWindowProcA
SetLayeredWindowAttributes
TranslateMessage
LoadIconA
PeekMessageA
PostQuitMessage
UpdateWindow
GetKeyState
LoadCursorA
ScreenToClient
SetCursorPos
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

msvcp140

?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ

urlmon

URLDownloadToFileA

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

vcruntime140

__std_exception_destroy
__std_exception_copy
__current_exception
__current_exception_context
_except_handler4_common
memset
_CxxThrowException
memmove
__std_terminate
__CxxFrameHandler3
memcpy
memchr
strstr

api-ms-win-crt-stdio-l1-1-0

__p__commode
ftell
fflush
__stdio_common_vsscanf
fseek
_set_fmode
__acrt_iob_func
fclose
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vfprintf
fread

api-ms-win-crt-utility-l1-1-0

srand
rand
qsort

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_configure_narrow_argv
_set_app_type
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_initialize_narrow_environment
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
exit
_beginthreadex
_controlfp_s
_seh_filter_exe

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

_libm_sse2_sqrt_precise
ceil
_libm_sse2_acos_precise
_libm_sse2_cos_precise
__setusermatherr
_libm_sse2_sin_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd7b76008cbbd7fcc9a725e53b83b369

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

imm32

d3dcompiler_43

dwmapi

d3d11

d3dx11_43

msvcp140

urlmon

wininet

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 297KB - Virtual size: 296KB

.rdata Size: 50KB - Virtual size: 50KB

.data Size: 2.8MB - Virtual size: 2.8MB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 297KB - Virtual size: 296KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 2.8MB - Virtual size: 2.8MB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 14KB - Virtual size: 13KB