Rainmeter[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Rainmeter.exe
Size

464KB
MD5

b7551e8b44b3ebbc1098945eee4e1508
SHA1

5152afca560c6fe4c61c633ab2a097c7be1a09ee
SHA256

9bcf2029204ad9ee2de119114085945bd08c2b07e8142c661e0072419d225a90
SHA512

89100d9376452699952e803e11d8b4b53af6915d19f1082242cf576a4eb04d0eae9deb4d48295645f3993b4d00882d54dce745b20922a96a6fe74b5a6d14800d
SSDEEP

1536:okQVCSl4ckovg4BmO2PHAmxbd3RHs6MNgu1BHc/yii:odVJlmoTmO2vBp4NgsHJP

Score

1^/10

Malware Config

Signatures

Files

Rainmeter.exe
.exe windows x64

9a66e65f22017f3d7b9d3b2daf36e546

Code Sign

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28-01-2021 00:00

Not After

28-01-2024 23:59

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b1:86:36:2d:8b:b6:f3:4a:b5:68:4b:37:47:03:23:52:0c:0b:d3:2b:78:84:d2:73:cb:a7:87:63:ce:69:9f:25
Signer

Actual PE Digest

b1:86:36:2d:8b:b6:f3:4a:b5:68:4b:37:47:03:23:52:0c:0b:d3:2b:78:84:d2:73:cb:a7:87:63:ce:69:9f:25

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FindResourceW
GetLastError
GetProcAddress
ExitProcess
SetErrorMode
LoadLibraryW
lstrcatW
SetCurrentDirectoryW
GetCommandLineW

user32

wsprintfW
MessageBoxW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 702B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a66e65f22017f3d7b9d3b2daf36e546

Code Sign

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1aCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

b1:86:36:2d:8b:b6:f3:4a:b5:68:4b:37:47:03:23:52:0c:0b:d3:2b:78:84:d2:73:cb:a7:87:63:ce:69:9f:25Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 1KB - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 24B

.idata Size: 1024B - Virtual size: 702B

.rsrc Size: 452KB - Virtual size: 451KB

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

b1:86:36:2d:8b:b6:f3:4a:b5:68:4b:37:47:03:23:52:0c:0b:d3:2b:78:84:d2:73:cb:a7:87:63:ce:69:9f:25
Signer

.text
Size: 1KB - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 24B

.idata
Size: 1024B - Virtual size: 702B

.rsrc
Size: 452KB - Virtual size: 451KB