Static task
static1
Behavioral task
behavioral1
Sample
rh_0.4.9rc1123.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
rh_0.4.9rc1123.exe
Resource
win10v2004-20230915-en
General
-
Target
rh_0.4.9rc1123.exe
-
Size
456KB
-
MD5
1cf749dd7209e826e36d8ece08aa6a7a
-
SHA1
59443fd4dbbe44b43c532c30333ba643a7ee69c4
-
SHA256
4ed48b6b978ebf13a362f8ff7a2d2c1fdf17f4a4d1f513c4851201f804c04ef9
-
SHA512
6a27d2a08e4a96828068f2330c3112974b2d8532902203557d2f9a0ced79a92fd6a0e0a1d233778d674889a4cfe27fb332f2b6a011c34fec5d3bd002f7d413d4
-
SSDEEP
6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+1:2uWP/BZUyoLu8Agsmxwrvejkd2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rh_0.4.9rc1123.exe
Files
-
rh_0.4.9rc1123.exe.exe windows:4 windows x86
eca0c30b65294d02a6c6180a6b323b58
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
HeapSize
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
InterlockedExchange
RtlUnwind
HeapReAlloc
VirtualAlloc
InitializeCriticalSection
LoadLibraryA
GetCPInfo
GetSystemInfo
GetACP
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
WriteFile
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
GetLastError
GetCurrentThreadId
SetLastError
TlsAlloc
GetProcAddress
HeapCreate
VirtualQuery
WaitForSingleObject
HeapDestroy
CreateEventW
ExitProcess
WideCharToMultiByte
OutputDebugStringW
CreateFileW
ReadFile
CloseHandle
GetCurrentProcess
MultiByteToWideChar
GetModuleHandleW
InterlockedIncrement
GetModuleFileNameW
lstrlenW
HeapFree
OutputDebugStringA
MulDiv
GetProcessHeap
HeapAlloc
GetOEMCP
GetVersionExA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
user32
GetClassInfoW
FrameRect
CharUpperBuffW
IsIconic
EnableWindow
DrawIcon
DeleteMenu
SetTimer
CreateAcceleratorTableW
GetSystemMenu
DrawMenuBar
SetMenuItemInfoW
GetWindowTextW
GetDCEx
RegisterClassW
GetMenuItemInfoW
SetScrollPos
FillRect
GetSystemMetrics
GetDC
MsgWaitForMultipleObjectsEx
EndMenu
DestroyCursor
IsZoomed
GetCursor
GetScrollPos
DispatchMessageW
DefFrameProcW
DestroyMenu
ReleaseDC
IsDialogMessageW
GetScrollRange
DefMDIChildProcW
GetMenuStringW
PeekMessageW
CopyImage
ShowCaret
LoadIconW
DrawFocusRect
LoadBitmapW
GetDlgCtrlID
LoadStringW
GetClassInfoExW
DestroyIcon
ShowWindow
EndPaint
PostMessageW
CreateWindowExW
BeginPaint
LoadCursorW
GetClientRect
InsertMenuW
CreateIcon
DestroyWindow
KillTimer
GetScrollInfo
CreateMenu
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
gdi32
Pie
AngleArc
Polygon
CreateSolidBrush
RectVisible
CreateICW
CreatePalette
PolyBezierTo
RoundRect
RestoreDC
GetWindowOrgEx
CreateCompatibleBitmap
MoveToEx
GetTextMetricsW
GetStockObject
SetTextColor
SetAbortProc
SetBkMode
StretchBlt
CreateDCW
GetDeviceCaps
SetRectRgn
GetEnhMetaFileHeader
ole32
OleInitialize
CoUninitialize
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
IsEqualGUID
CoInitialize
CoCreateInstance
oleaut32
VariantChangeType
SafeArrayPutElement
VariantCopy
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
GetErrorInfo
VariantInit
SafeArrayPtrOfIndex
SysAllocStringLen
SafeArrayGetLBound
SafeArrayAccessData
VariantCopyInd
SysReAllocStringLen
SafeArrayCreate
SafeArrayUnaccessData
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
winspool.drv
EnumPrintersW
ord203
OpenPrinterW
ClosePrinter
DocumentPropertiesW
Sections
.text Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 324KB - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE