RCO2Installer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

RCO2Installer.exe
Size

706KB
MD5

30998e1e3fc08e5d558f8a5a7a4f90b7
SHA1

0a429c9274d381f3e422d95ca6f65fa8804731cf
SHA256

df979e95e56c2023e0fc3342fededa880fad95b47f9b7ee6e7133c89017be581
SHA512

24b809f61dfd603be297503fb2d60d019406eeaa1b3bbb8e6dcd6dbb07d4ad9be8ec7c94518b7878389f46a9eab58122100d4b8f9c0f4531ee51df9d5e0aac18
SSDEEP

12288:vQ1i1+PndRAV0Z/VTEMm1cLPgpUrZCjiFSDjkZ1wvUf0mcOnfhqz9nq:vQ12V0Z/V3m1cLWUtDFSxQD1JCQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RCO2Installer.exe

Files

RCO2Installer.exe
.exe windows x86

ec9693ca116e777f25b28a8011497001

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSACreateEvent
WSAStartup
WSACleanup
setsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAEnumNetworkEvents
send
WSASetLastError
WSACloseEvent
getsockopt

wldap32

ord211
ord217
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143
ord46

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

normaliz

IdnToAscii

kernel32

FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandleEx
GetFileSizeEx
CreateFileA
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
FindFirstFileExW
VerifyVersionInfoW
VerSetConditionMask
CloseHandle
CreateProcessA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx

advapi32

CryptGetHashParam
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
RegDeleteValueA
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegSetValueExA
RegOpenKeyExA

msvcp140

?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
_Query_perf_frequency
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

bcrypt

BCryptGenRandom

vcruntime140

_except_handler4_common
__current_exception_context
__current_exception
_CxxThrowException
strstr
__std_exception_destroy
memchr
strrchr
memcpy
strchr
memset
__std_terminate
__std_exception_copy
memmove
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
calloc
realloc
_set_new_mode
free

api-ms-win-crt-stdio-l1-1-0

fopen_s
_close
_write
_read
_open
__p__commode
fopen
__stdio_common_vsprintf
fputc
fflush
_set_fmode
__stdio_common_vsscanf
fread
fgets
_lseeki64
ftell
fwrite
feof
__acrt_iob_func
fseek
fclose
fputs

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_c_exit
_controlfp_s
_seh_filter_exe
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_cexit
__sys_errlist
__p___argv
__sys_nerr
__p___argc
_set_app_type
terminate
exit
_invalid_parameter_noinfo_noreturn
_beginthreadex
_exit
_errno

api-ms-win-crt-string-l1-1-0

strcspn
strspn
strncpy
strpbrk
strncmp
_strdup

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64
strftime

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
wcstombs
atoi
strtoll

api-ms-win-crt-filesystem-l1-1-0

_stat64
_unlink
_fstat64
_access

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr

Sections

.text
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec9693ca116e777f25b28a8011497001

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

crypt32

normaliz

kernel32

advapi32

msvcp140

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 357KB - Virtual size: 357KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 265KB - Virtual size: 264KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 357KB - Virtual size: 357KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 265KB - Virtual size: 264KB

.reloc
Size: 16KB - Virtual size: 15KB