r[.]exe | Triage

Sharing

General

Target

r.exe
Size

43KB
MD5

42b7a689dceb3fc309afd809464806b9
SHA1

df108c9807b29edc077f4b19421e3b5088a2be07
SHA256

0ed7193f1edfdcdcf8699111ef29104041a3dfb8a10f598114b05f1598661c48
SHA512

a1a0815ed5532279198a1a5c52b5ab0169be707a44025af05d06e0f7492c90eacfa00e91cce7e57c7e9b511ecad19672ff4fc2a0da14f33f33c222dcaef75510
SSDEEP

768:kqLWcxyMY7T2EX69ToENI2+UB8gNzQckMBc/6HgJ6EuKf:xWNMCT9X/UmgNzlkMy6HeX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
r.exe

Files

r.exe
.exe windows x86

1688500b2e2c447491b53acc8de1652d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetStdHandle
GetModuleFileNameW
HeapReAlloc
HeapAlloc
WriteConsoleW
VerSetConditionMask
GetProcessHeap
FindFirstFileW
FindNextFileW
WriteFile
WaitForMultipleObjects
FindClose
ExitThread
Sleep
GetDriveTypeW
ReadFile
SetFilePointerEx
LoadLibraryA
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateSemaphoreA
ExitProcess

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ