anna-rs[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

anna-rs.exe
Size

5.2MB
MD5

b3e1dfa84d0a1dea76d3c4af1bf3102a
SHA1

39cad21e89f1af6b1a3973496d3d95cba04bcf9c
SHA256

98723cd2b52ca114b1518cd3403659d7e4c3700d4c55d71c7df0a1b2454e5231
SHA512

1bb3178d0a76a28a00af8f869a9d246155f8fd5916d0c692535c8f523f4839639d48182d9db43bc6b5107b91dbd81e3fd0f4819d30f00c2f957c067f3b6c7f8c
SSDEEP

98304:8H/e6NKz5JJWxFHolCb4Xg7+lSx4ave2VGuTqJ3T/l73DZVA6swL+/P6QDCg:8miQ5295x4ave2VGuTqJ3T/l73DZVA6y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
anna-rs.exe

Files

anna-rs.exe
.exe windows:6 windows x64 arch:x64

c996bc178b0a68f27edf6fd1d6c80530

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetUserDefaultUILanguage
lstrlenW
DeleteCriticalSection
RtlUnwindEx
TryAcquireSRWLockExclusive
GetCurrentThreadId
LeaveCriticalSection
ResetEvent
InitializeSListHead
CloseHandle
EnterCriticalSection
RtlVirtualUnwind
IsDebuggerPresent
LCIDToLocaleName
SetUnhandledExceptionFilter
OpenProcess
InitializeCriticalSectionAndSpinCount
VirtualQueryEx
ReadProcessMemory
GetModuleHandleW
GetTempPathW
VirtualProtectEx
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
CreateThread
LoadLibraryW
UnhandledExceptionFilter
GetProcAddress
WriteConsoleW
MultiByteToWideChar
GetFullPathNameW
ExitProcess
GetConsoleMode
CreateEventW
GetFinalPathNameByHandleW
LoadLibraryA
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
CreateFileW
CreateMutexA
WaitForSingleObjectEx
GetFileAttributesW
GetModuleFileNameW
GetLastError
OutputDebugStringA
OutputDebugStringW
RtlPcToFileHeader
RaiseException
LoadLibraryExW
EncodePointer
TlsAlloc
TlsFree
ReleaseSRWLockExclusive
FreeLibrary
GetEnvironmentVariableW
SleepConditionVariableSRW
ReleaseSRWLockShared
GetSystemInfo
WriteProcessMemory
IsProcessorFeaturePresent
AcquireSRWLockShared
HeapReAlloc
QueryPerformanceFrequency
GetProcessHeap
HeapAlloc
HeapFree
SetEvent
WaitForSingleObject
QueryPerformanceCounter
WakeConditionVariable
WakeAllConditionVariable
FormatMessageW
Sleep
GetModuleHandleA
GetFileInformationByHandle
TerminateProcess
ReleaseMutex
FindClose
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
SetEnvironmentVariableW
AcquireSRWLockExclusive
GetCommandLineW
GetCurrentProcessId
GetStdHandle
RtlUnwind

user32

ToUnicodeEx
VkKeyScanW
MapVirtualKeyExW
GetKeyState
GetKeyboardState
IsWindowVisible
AdjustWindowRectEx
GetRawInputData
PeekMessageW
TranslateMessage
DispatchMessageW
ShowCursor
ClipCursor
GetClipCursor
SetWindowLongW
GetSystemMenu
SendMessageW
DestroyIcon
GetWindowRect
SetCursorPos
SetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
GetClientRect
EnumDisplayMonitors
SetWindowPos
MapVirtualKeyW
GetMessageW
GetAncestor
GetForegroundWindow
ChangeDisplaySettingsExW
GetDC
PostQuitMessage
SendInput
FlashWindowEx
ShowWindow
TranslateAcceleratorW
AppendMenuW
SystemParametersInfoA
PostThreadMessageW
SetWindowPlacement
ClientToScreen
PostMessageA
InvalidateRgn
GetMessageA
DispatchMessageA
GetActiveWindow
IsIconic
CreateMenu
SetMenuItemInfoW
GetWindowLongPtrW
SetWindowDisplayAffinity
GetMenu
SetMenu
LoadCursorW
CreateAcceleratorTableW
CheckMenuItem
EnableMenuItem
DestroyAcceleratorTable
CreateIcon
SetCapture
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
GetKeyboardLayout
RegisterClassExW
RegisterWindowMessageA
GetAsyncKeyState
EnumChildWindows
ReleaseCapture
SetCursor
GetCursorPos
FindWindowA
IsProcessDPIAware
GetMonitorInfoW
DestroyWindow
MonitorFromWindow
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
GetWindowLongW
TrackMouseEvent
MonitorFromRect
RedrawWindow
GetUpdateRect
ValidateRect
PostMessageW
MonitorFromPoint
RegisterTouchWindow
GetSystemMetrics
IsWindow
CreateWindowExW
GetWindowPlacement
DefWindowProcW

comctl32

SetWindowSubclass
DefSubclassProc
RemoveWindowSubclass

gdi32

DeleteObject
CreateRectRgn
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
RevokeDragDrop
OleInitialize
CoCreateInstance
RegisterDragDrop
CoInitializeEx
CoTaskMemAlloc

shell32

DragQueryFileW
SHGetKnownFolderPath
DragFinish
SHAppBarMessage
ShellExecuteW

uxtheme

SetWindowTheme

advapi32

RegGetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
SystemFunction036

bcrypt

BCryptGenRandom

oleaut32

SysFreeString
SysStringLen
SetErrorInfo
GetErrorInfo

ntdll

RtlNtStatusToDosError
NtWriteFile

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameA

api-ms-win-crt-math-l1-1-0

trunc
round
pow
floor
__setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen
strcpy_s
_wcsicmp
wcsncmp
strlen

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initterm_e
_crt_atexit
_exit
_configure_narrow_argv
_set_app_type
__p___argc
_seh_filter_exe
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
abort
_initialize_onexit_table
_register_onexit_function
_initterm
terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
_set_new_mode
calloc

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c996bc178b0a68f27edf6fd1d6c80530

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comctl32

gdi32

dwmapi

ole32

shell32

uxtheme

advapi32

bcrypt

oleaut32

ntdll

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 166KB - Virtual size: 165KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 166KB - Virtual size: 165KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 27KB - Virtual size: 27KB