RMActivate_isv[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RMActivate_isv.exe
Size

534KB
MD5

111bdde32c1302c0c1acea565cdc6792
SHA1

571bb8d06c8e39a993633ca94c2535de3159b30a
SHA256

18f1b4e40d16cb903f6f6e268893e3335a92d6f172bda2da9cce0e7202d38d74
SHA512

b1ba5e63ef4e0994d0f0c80864343cb2184cab322a34e621f730970395bc577ef58cf2e1b0be37ba502e8d7bb6a89f2fa3af0c8265714cb377b3b2a202f926f2
SSDEEP

12288:296VNsjjz7J5h6q7YEStsoABub/RHwFVexAM+YrUGt9erYuyUiN:296V6jjfjvBe5HTxO8DerYbUiN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RMActivate_isv.exe

Files

RMActivate_isv.exe
.exe windows x86

d65439baa3eb2471910f2ebc1fe1062d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsnicmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
??1type_info@@UAE@XZ
__CxxFrameHandler3
memmove
wcscpy_s
_snwprintf_s
_stricmp
??0exception@@QAE@ABQBD@Z
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
memcpy
_callnewh
malloc
free
_wcsicmp
memset

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-memory-l1-1-2

VirtualProtect
VirtualAlloc
VirtualFree

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
Sleep
InitializeCriticalSection
CreateMutexA
DeleteCriticalSection
ReleaseMutex
EnterCriticalSection
WaitForSingleObject

api-ms-win-core-errorhandling-l1-1-1

SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
FreeLibrary
LoadLibraryExA
GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
GetSystemTime
GetSystemWindowsDirectoryW
GetSystemDirectoryW

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException
LoadLibraryW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags

api-ms-win-core-heap-l1-2-0

HeapSetInformation

api-ms-win-core-com-l1-1-1

CoTaskMemFree
CoCreateGuid

crypt32

CertVerifyCertificateChainPolicy
CryptProtectData

api-ms-win-core-file-l1-2-1

CreateFileW
GetVolumeInformationW
GetLogicalDriveStringsW
GetDriveTypeW
CreateFileA
DeleteFileW

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-registry-l1-1-0

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
RegCloseKey

api-ms-win-core-processenvironment-l1-2-0

GetEnvironmentStringsW

api-ms-win-eventing-obsolete-l1-1-0

RegisterTraceGuidsA

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

api-ms-win-core-toolhelp-l1-1-0

Module32FirstW
CreateToolhelp32Snapshot
Module32NextW

cryptsp

CryptGetHashParam
CryptContextAddRef
CryptAcquireContextW
CryptDestroyHash
CryptReleaseContext
CryptGetDefaultProviderW
CryptGenRandom
CryptDeriveKey
CryptDestroyKey
CryptGenKey
CryptExportKey
CryptCreateHash
CryptHashData

api-ms-win-shell-shellfolders-l1-1-0

SHGetKnownFolderPath

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

Sections

.text
Size: 509KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d65439baa3eb2471910f2ebc1fe1062d

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-memory-l1-1-2

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-com-l1-1-1

crypt32

api-ms-win-core-file-l1-2-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-eventing-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

cryptsp

api-ms-win-shell-shellfolders-l1-1-0

wintrust

Sections

.text Size: 509KB - Virtual size: 508KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 509KB - Virtual size: 508KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 17KB - Virtual size: 16KB