RMActivate_ssp_isv[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RMActivate_ssp_isv.exe
Size

474KB
MD5

aa8f721d6ff84383323a1fcee1d79431
SHA1

23f173ac74f04bc35977f2121cbbb0590110177f
SHA256

2ef0dff80fb2b7d149fd2249a104b12d4658bdda1307daec22ac74fd61ce4a59
SHA512

d652ce2e970caea1175bae59f72765bf00a4d8e3810a5502c8ed880bfc520457a15c1ca70821d94795727660e01653cb6e3c734d885ce347499f05608926aff4
SSDEEP

12288:LehJzi1aaAUEo1EsXPHIHDKFT9ReRID8BDkH1:EJziDAUB5/IHDKFT9ReRM8BDc1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RMActivate_ssp_isv.exe

Files

RMActivate_ssp_isv.exe
.exe windows x86

d77af26b5e60cc90028d77543e5199b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcpy
wcscpy_s
_snwprintf_s
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
_callnewh
malloc
free
_stricmp
memset

api-ms-win-core-memory-l1-1-2

VirtualFree
VirtualQuery
VirtualAlloc
VirtualProtect

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-2-0

Sleep
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentThread
OpenProcessToken

api-ms-win-core-errorhandling-l1-1-3

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
LoadLibraryExA
GetModuleHandleA
FreeLibrary

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemInfo
GetSystemTime
GetVersionExA
GetSystemTimeAsFileTime

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapSetInformation
HeapFree

api-ms-win-core-com-l1-1-1

CoCreateGuid

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

cryptsp

CryptDestroyKey
CryptSetProvParam
CryptExportKey
CryptDestroyHash
CryptGenKey
CryptCreateHash
CryptHashData
CryptGetDefaultProviderW
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam

api-ms-win-eventing-obsolete-l1-1-0

RegisterTraceGuidsA

Sections

.text
Size: 457KB - Virtual size: 457KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d77af26b5e60cc90028d77543e5199b8

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-memory-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-com-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

cryptsp

api-ms-win-eventing-obsolete-l1-1-0

Sections

.text Size: 457KB - Virtual size: 457KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 457KB - Virtual size: 457KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 7KB