__dbk_fcall_wrapper
dbkFCallWrapperAddr
Static task
static1
1 signatures
General
-
Target
Remcos-v4.9.3-Light.zip
-
Size
38.8MB
-
MD5
00534b114c5a7aebf2d70f551ef7b40f
-
SHA1
263eefd82c1993ac8b848418dd791728dc53faff
-
SHA256
b3220278991e82d522b8b6319a1730a29e213f142312b5b3fc0a307d0201bb1b
-
SHA512
8154d397aa329ecd57006806af38703d3cca7c97677644d361ef7c48e17098339c023067e586863c0c7cb49afb56591e7b4c71ce83825bf9dea166549dc00938
-
SSDEEP
786432:MM4OewGmQ2R3JTBSZtp+k6y+U46ltj5KEBYnqgac1iNgejyHnt:MKeHmQA3Mp+SJbltj5KEBYMc1iNTjk
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Remcos v4.9.3 Light.exe
Files
-
Remcos-v4.9.3-Light.zip.zip
Password: BreakingSecurity.net
-
ReadMe.txt
-
Remcos v4.9.3 Light.exe.exe windows:5 windows x86 arch:x86
Password: BreakingSecurity.net
d05d0a33106fabd34cd37130060b0c44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundW
wininet
InternetCloseHandle
winspool.drv
DocumentPropertiesW
comdlg32
GetSaveFileNameW
comctl32
ImageList_GetImageInfo
ws2_32
htons
shell32
SHGetFileInfoW
user32
MoveWindow
version
GetFileVersionInfoSizeW
oleaut32
SysFreeString
advapi32
RegSetValueExW
msvcrt
memcpy
kernel32
GetVersion
GetVersionExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
wsock32
htons
ole32
IsEqualGUID
gdi32
Pie
Exports
Exports
Sections
.text Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 364KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 113B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 84B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.viotto0 Size: - Virtual size: 54.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.viotto1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.viotto2 Size: 38.9MB - Virtual size: 38.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 282KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
zip_password.txt