96006989931881932ca450a287c37f2b

Sharing

Copy URL Twitter E-mail

General

Target
96006989931881932ca450a287c37f2b
Size 1.2MB
Sample240212-cxrh7aad72
SHA256 6e4459abab047b1f7ed918e6b9dc6604068edb826f2c2683f9a701ed0aae0d97
MD5 96006989931881932ca450a287c37f2b
SHA1 472f07e62c175a69bbfc25ae011725ed747c952a
SHA512 7ae0b75fb049f5510b4aacb392acc4c637db74663adade9bd26a66d4e9a958782f618a76ba6f747efabf6362d55e2805a10196ff5744a5d60b06b51472092c71
SSDEEP 24576:W1RXG0C0UbaOLDmEcoVxANz+v67TVpzEKXpkEZopVLv:yXSDENzx7vhG/v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
96006989931881932ca450a287c37f2b
unpack001/$PLUGINSDIR/rardat.exe

File Explorer

96006989931881932ca450a287c37f2b

.exe 1.2MB
$PLUGINSDIR/rardat.exe

.exe 917KB

96006989931881932ca450a287c37f2b

IMPHASH 18bc6fa81e19f21156316b1ae696ed6b
SHA256 6e4459abab047b1f7ed918e6b9dc6604068edb826f2c2683f9a701ed0aae0d97
MD5 96006989931881932ca450a287c37f2b
SHA1 472f07e62c175a69bbfc25ae011725ed747c952a
SHA512 7ae0b75fb049f5510b4aacb392acc4c637db74663adade9bd26a66d4e9a958782f618a76ba6f747efabf6362d55e2805a10196ff5744a5d60b06b51472092c71
SSDEEP 24576:W1RXG0C0UbaOLDmEcoVxANz+v67TVpzEKXpkEZopVLv:yXSDENzx7vhG/v
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess lstrcmpiA ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/rardat.exe

SHA256 37abdcff8dcf03e3e2e3cda9dbff1e03ac00a4eb240162597963e2eb5d6f8682
MD5 4091f1194795d5f624804aed9441430b
SHA1 b29a275fd36d0201fec8e2c41244d07ebefdc172
SHA512 3c3fa69da11de119b83303c5fe2ca08dec3e79cc9e6700b189a8dfc71468100f83e9c726d7e8185e98ff6ed67e04e8379020073315679459c400119eeadb4b14
SSDEEP 24576:kG0C0UbaOLDmEcoVxANz+v67TVpzEKXpkEZopVLv:kSDENzx7vhG/v
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

684500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

668KB

Virtual Size

668KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

320KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc1

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

576KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

364KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

96006989931881932ca450a287c37f2b

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/rardat.exe

generic