Static task
static1
Behavioral task
behavioral1
Sample
Ricochet.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Ricochet.exe
Resource
win10v2004-20230915-en
General
-
Target
Ricochet.exe
-
Size
1.3MB
-
MD5
03225ff5a9b18c56706e30824e0fc741
-
SHA1
0277eb01813c5cf00c2e5f083b62955aa1fd1e6c
-
SHA256
cbf498136b4531e480f9a73a59b921b9b88b5ecc2b445f283991740ca879c76d
-
SHA512
728d25da54d67d16fefc4e998f2cc6dde0c259375a017bd5247ecff81ada22a2774461baa3308282411cb8c48440bd342b2c594ca6fcee64af7ac25cfa496829
-
SSDEEP
24576:foh6FM8PNFg+paJJBzbph0HvLL+eA1xY6uWBKtZ48oyWtIfwuH:5NEB1O6u26oLts
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ricochet.exe
Files
-
Ricochet.exe.exe windows:4 windows x86
4f6cb6cfe313b0a9d8c3caa2e12144b5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msacm32
acmStreamClose
acmStreamOpen
acmStreamSize
acmStreamPrepareHeader
acmFormatSuggest
acmStreamUnprepareHeader
acmStreamConvert
winmm
timeSetEvent
timeKillEvent
joyGetDevCapsA
joyGetPosEx
joyGetNumDevs
ddraw
DirectDrawCreate
dsound
ord1
kernel32
CompareStringA
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetStdHandle
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
ReadFile
FlushFileBuffers
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
LCMapStringW
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
RaiseException
HeapSize
GetTempPathA
GetTempFileNameA
GetSystemTimeAsFileTime
FileTimeToDosDateTime
OpenMutexA
CloseHandle
CreateMutexA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindNextFileA
FindClose
LoadLibraryA
GetProcAddress
FreeLibrary
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapReAlloc
HeapFree
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
SetEnvironmentVariableA
Sleep
QueryPerformanceFrequency
GetFileAttributesA
QueryPerformanceCounter
ReleaseMutex
WaitForSingleObject
MulDiv
GetExitCodeProcess
CreateProcessA
GetTickCount
SetCurrentDirectoryA
GetModuleFileNameA
WriteFile
RemoveDirectoryA
GetVersion
GetPrivateProfileStringA
GetLastError
SetFileAttributesA
WritePrivateProfileStringA
GetPrivateProfileIntA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CreateFileA
GetFileTime
CreateDirectoryA
LCMapStringA
DeleteFileA
MoveFileA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
HeapAlloc
SetEndOfFile
user32
CloseClipboard
GetActiveWindow
MoveWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcA
IsIconic
PeekMessageA
TranslateMessage
DispatchMessageA
GetClientRect
OffsetRect
ClientToScreen
SetCursorPos
GetKeyNameTextA
SetCursor
ShowWindow
GetDesktopWindow
SetForegroundWindow
PostMessageA
GetDC
ReleaseDC
SetRect
GetMenu
AdjustWindowRectEx
SetWindowPos
SystemParametersInfoA
GetWindowRect
GetWindowLongA
SetWindowLongA
MessageBoxA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
UpdateWindow
SetFocus
RegisterWindowMessageA
GetClipboardData
OpenClipboard
EmptyClipboard
RegisterClipboardFormatA
SetClipboardData
gdi32
GetSystemPaletteEntries
CreateFontA
DeleteObject
GetDeviceCaps
GetStockObject
advapi32
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptImportKey
CryptDestroyHash
CryptVerifySignatureA
CryptDestroyKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateGuid
ifc22
?GetProductGUIDString@CImmMouse@@UAEHPADH@Z
?CreateEffect@CImmProject@@QAEPAVCImmCompoundEffect@@PBDPAVCImmDevice@@K@Z
?DestroyEffect@CImmProject@@QAEXPAVCImmCompoundEffect@@@Z
?GetContainedEffect@CImmCompoundEffect@@QAEPAVCImmEffect@@J@Z
?GetStatus@CImmEffect@@QAEHPAK@Z
?Stop@CImmCompoundEffect@@QAEHXZ
?Start@CImmCompoundEffect@@QAEHKK@Z
??1CImmDXDevice@@UAE@XZ
??1CImmMouse@@UAE@XZ
??0CImmMouse@@QAE@XZ
?Initialize@CImmMouse@@QAEHPAX0KH@Z
??0CImmDXDevice@@QAE@XZ
?Initialize@CImmDXDevice@@QAEHPAX0PAUIDirectInputA@@PAUIDirectInputDevice2A@@H@Z
??0CImmProject@@QAE@XZ
?LoadProjectFromMemory@CImmProject@@QAEHPAXPAVCImmDevice@@@Z
??1CImmProject@@QAE@XZ
?GetAPI@CImmDXDevice@@UAEPAUIFeelit@@XZ
?GetDevice@CImmDXDevice@@UAEPAUIFeelitDevice@@XZ
?GetProductType@CImmDXDevice@@UAEKXZ
?GetDriverVersion@CImmDXDevice@@UAEHAAK00@Z
?GetProductName@CImmDXDevice@@UAEHPADH@Z
?GetProductGUIDString@CImmDXDevice@@UAEHPADH@Z
?GetProductGUID@CImmDXDevice@@UAE?AU_GUID@@XZ
?GetCurrentPosition@CImmDXDevice@@UAEHAAJ0@Z
?ChangeScreenResolution@CImmDevice@@UAEHHKK@Z
?SwitchToAbsoluteMode@CImmDevice@@UAEHH@Z
?prepare_device@CImmDevice@@MAEHXZ
?reset@CImmDXDevice@@MAEXXZ
?GetAPI@CImmMouse@@UAEPAUIFeelit@@XZ
?GetDevice@CImmMouse@@UAEPAUIFeelitDevice@@XZ
?GetProductType@CImmMouse@@UAEKXZ
?GetDriverVersion@CImmMouse@@UAEHAAK00@Z
?GetProductName@CImmMouse@@UAEHPADH@Z
?GetProductGUID@CImmMouse@@UAE?AU_GUID@@XZ
?GetCurrentPosition@CImmMouse@@UAEHAAJ0@Z
?ChangeScreenResolution@CImmMouse@@UAEHHKK@Z
?SwitchToAbsoluteMode@CImmMouse@@UAEHH@Z
?prepare_device@CImmMouse@@MAEHXZ
?reset@CImmMouse@@MAEXXZ
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 788KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ