RMActivate[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RMActivate.exe
Size

531KB
MD5

fbb333226156159b843f31253708b853
SHA1

b772d400f0790cb063678c02715223c4d1a176f1
SHA256

7870240a230355ae6446183ee800e219c475d97f96569f0ae35c4b6d1fc905e0
SHA512

a1051d7b7d594f355e6f7be6e4b39c94a2a092cf440c54f09eacbc68010d25a2c1ad526e02a030e24c15caea0d25d87cc0bfe54e69044f99daf04c4d23721031
SSDEEP

12288:42Jsj+Y+Z849b1TmKjTEJT9ftgUYpFXAugdSzvzz7/Gyp2:4vj5+ZgyTEvfWUYvXAugczvzXfk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RMActivate.exe

Files

RMActivate.exe
.exe windows x86

63523fde0ba2aa389adb3296245de154

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

?what@exception@@UBEPBDXZ
_CxxThrowException
??1type_info@@UAE@XZ
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler3
??0exception@@QAE@ABQBD@Z
_stricmp
memcpy
_wcsnicmp
_wcsicmp
memmove
wcscpy_s
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
??1exception@@UAE@XZ
_callnewh
malloc
free
_snwprintf_s
memset

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-memory-l1-1-2

VirtualFree
VirtualAlloc
VirtualProtect

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
LeaveCriticalSection
Sleep
CreateMutexA
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
ReleaseMutex

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleA
GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetVersionExA
GetSystemTime
GetTickCount
GetSystemDirectoryW

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW
RaiseFailFastException

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
TraceMessage

api-ms-win-core-heap-l1-2-0

HeapSetInformation

api-ms-win-core-com-l1-1-1

CoCreateGuid
CoTaskMemFree

crypt32

CertVerifyCertificateChainPolicy
CryptProtectData

api-ms-win-core-file-l1-2-1

CreateFileW
GetVolumeInformationW
DeleteFileW
GetLogicalDriveStringsW
GetDriveTypeW
CreateFileA

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-registry-l1-1-0

RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentStringsW

api-ms-win-eventing-obsolete-l1-1-0

RegisterTraceGuidsA

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-toolhelp-l1-1-0

Module32FirstW
CreateToolhelp32Snapshot
Module32NextW

cryptsp

CryptGenKey
CryptExportKey
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptContextAddRef
CryptAcquireContextW
CryptReleaseContext
CryptGetDefaultProviderW
CryptGenRandom
CryptDeriveKey
CryptDestroyKey
CryptDestroyHash

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

Sections

.text
Size: 513KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63523fde0ba2aa389adb3296245de154

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-memory-l1-1-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-com-l1-1-1

crypt32

api-ms-win-core-file-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-eventing-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

cryptsp

api-ms-win-core-delayload-l1-1-1

api-ms-win-shell-shellfolders-l1-1-0

wintrust

Sections

.text Size: 513KB - Virtual size: 512KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 513KB - Virtual size: 512KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 8KB