D:\Richard Burns Rally\Plugins\RBRTestPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fd7d6723fac1d9485c8b714ce2adc888bfb6784792902697146b34707b1c6dea.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd7d6723fac1d9485c8b714ce2adc888bfb6784792902697146b34707b1c6dea.dll
Resource
win10v2004-20240221-en
General
-
Target
fd7d6723fac1d9485c8b714ce2adc888bfb6784792902697146b34707b1c6dea
-
Size
72KB
-
MD5
ca0f246882c42a19be792e8e5d419f69
-
SHA1
3bd6c788e92a43cfeea6bf955439e2a0aa20a0c1
-
SHA256
fd7d6723fac1d9485c8b714ce2adc888bfb6784792902697146b34707b1c6dea
-
SHA512
725dc7e127f4d609a7ac10ccfce4ae54ba605fcfebc4c289b9ddfb765bbba27fa3f1e3b73ae660cb4bc679bb1cb1ae1f713b3a532e21ac196887bfe59aa79c5e
-
SSDEEP
1536:xGK/Yhhhq2HQoFkg9U/IqOBAYRwujEhcajx:z/IwNa3n24Ehc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd7d6723fac1d9485c8b714ce2adc888bfb6784792902697146b34707b1c6dea
Files
-
fd7d6723fac1d9485c8b714ce2adc888bfb6784792902697146b34707b1c6dea.dll windows:4 windows x86 arch:x86
fe0c1eb85be762f47127b354504e39e3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
psapi
EnumProcessModules
GetModuleFileNameExA
kernel32
GetEnvironmentStrings
CloseHandle
ReadProcessMemory
OpenProcess
WriteProcessMemory
VirtualProtectEx
FlushInstructionCache
Sleep
CreateThread
GetCurrentProcessId
ExitProcess
RtlUnwind
GetCurrentThreadId
TlsSetValue
GetCommandLineA
GetVersionExA
GetProcAddress
GetModuleHandleA
HeapFree
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetModuleFileNameA
TlsFree
SetLastError
TlsGetValue
GetLastError
TlsAlloc
EnterCriticalSection
LeaveCriticalSection
WriteFile
FlushFileBuffers
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
SetFilePointer
VirtualAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
InitializeCriticalSection
CreateFileA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetEndOfFile
ReadFile
HeapSize
VirtualProtect
GetSystemInfo
VirtualQuery
Exports
Exports
RBR_CreatePlugin
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ