Static task
static1
Behavioral task
behavioral1
Sample
R3ACS.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
R3ACS.dll
Resource
win10v2004-20231215-en
General
-
Target
3edb082f5e5ed3d73b3ca2fc87bc5a18
-
Size
2.9MB
-
MD5
3edb082f5e5ed3d73b3ca2fc87bc5a18
-
SHA1
ad54ee22f24df7af6e1ae3ccdf68d1548484c6b6
-
SHA256
38755fe8d50b9c00231ad0e7c1dff88780b4c1de3bd3ed7d42f27e5bff8e2d8c
-
SHA512
8563db201296ac465dbe5e04fb573713d77ea5ae1a66eec494dd4c3340579d2cb5f7d5b2f8c12458a0867b356defaf4afce0ee07c8d952bb1a4b029aa5848b42
-
SSDEEP
49152:a6USVpjpnI8TV7tIDmDqjbFLhF7lSPkv0d2E1JTbwreUIc2U3YwPEbnf3Y859o:CqI8dmBLhZlSPdfLTbw7Ic4vX59o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/R3ACS.dll
Files
-
3edb082f5e5ed3d73b3ca2fc87bc5a18.zip
-
Data/ACHIEVE_title.tbl
-
Data/UPC_DefaultLooks.tbl
-
Data/Zones.tbl
-
Data/item_org_us.tbl
-
R3ACS.dll.dll windows:6 windows x86 arch:x86
4c6faeb10d435559e2d17f47557fcc3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
iphlpapi
GetAdaptersInfo
ws2_32
send
wininet
InternetConnectA
FtpPutFileA
InternetCloseHandle
InternetOpenA
gdiplus
GdipDisposeImage
GdipAlloc
GdipFree
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipSaveImageToFile
GdipGetImageEncodersSize
kernel32
FindClose
HeapReAlloc
GetConsoleCP
GetTickCount
CloseHandle
CreateFileW
DeviceIoControl
IsBadReadPtr
WriteProcessMemory
DeleteFileA
VirtualProtect
GetCurrentThreadId
SuspendThread
ResumeThread
WaitForSingleObject
TerminateProcess
CreateToolhelp32Snapshot
Module32FirstW
FindNextFileW
GetModuleHandleA
Process32FirstW
GetCurrentProcessId
Process32NextW
GetCommandLineW
GlobalFree
CreateTimerQueueTimer
Sleep
ExitProcess
GetLastError
CreateFileA
OpenProcess
CreateThread
WriteFile
FlushFileBuffers
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
FindFirstFileExW
Module32NextW
GetConsoleMode
SetFilePointerEx
GetFileSizeEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
RtlUnwind
RaiseException
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
ReadFile
GetModuleHandleExW
GetModuleFileNameW
GetTimeZoneInformation
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
user32
FindWindowA
wsprintfA
MessageBoxA
SetWindowTextA
gdi32
CreateCompatibleDC
DeleteObject
RestoreDC
BitBlt
SelectObject
SaveDC
DeleteDC
CreateDIBSection
GetDeviceCaps
CreateDCA
advapi32
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
shell32
ShellExecuteA
ShellExecuteExA
CommandLineToArgvW
Sections
.text Size: 244KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.9MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
R3ACS.ini