HEUR-Trojan-Dropper[.]Win32[.]Roxer[.]pef-a23ad7254dd71f63f41af180f0518fa85a22eefa657c051c1ed0ae4d3c1fff94

Sharing

Copy URL Twitter E-mail

General

Target

HEUR-Trojan-Dropper.Win32.Roxer.pef-a23ad7254dd71f63f41af180f0518fa85a22eefa657c051c1ed0ae4d3c1fff94
Size

2.7MB
MD5

17e2086fa92898f2c42622ed97359f56
SHA1

df3e7333d7fadcb2fcf0ab3e75898dfd33541d56
SHA256

a23ad7254dd71f63f41af180f0518fa85a22eefa657c051c1ed0ae4d3c1fff94
SHA512

babf6c59ca20e6a78f56711197d7fabe2d3fd58223a234850bb878279939f3385882bd6571c5ff4e413918d1e5d35cee77857144943d43210b3f4ebaaeda75db
SSDEEP

49152:AjpteVE9Qh6hgCRGvbrDC5L4y5FPc79RP1TgAq+X0p9GYasaXU/5V6CkthZvkfer:Qp0E97hUnC5L4yfPcfP18AT69GYasqUt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HEUR-Trojan-Dropper.Win32.Roxer.pef-a23ad7254dd71f63f41af180f0518fa85a22eefa657c051c1ed0ae4d3c1fff94

Files

HEUR-Trojan-Dropper.Win32.Roxer.pef-a23ad7254dd71f63f41af180f0518fa85a22eefa657c051c1ed0ae4d3c1fff94
.dll windows:6 windows x86 arch:x86

37f59f2d9fb6e01e3f93c12ecc45160e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Hasan\R2 Client CPP\Release\r2.pdb

Imports

kernel32

VirtualProtect
GetCommandLineW
LocalFree
GetCurrentThread
DisableThreadLibraryCalls
Sleep
CloseHandle
CreateThread
CreateProcessW
GetTickCount
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
VirtualQuery
SetLastError
GetModuleHandleA
InterlockedCompareExchange
ResumeThread
FlushInstructionCache
GetThreadContext
SetThreadContext
GetLastError
SuspendThread
VirtualAlloc
UnhandledExceptionFilter

shell32

CommandLineToArgvW

msvcp140

_Cnd_signal
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Mtx_init
_Thrd_start
_Thrd_detach
_Mtx_destroy
_Cnd_init
_Mtx_unlock
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Xlength_error@std@@YAXPBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Winerror_map@std@@YAHH@Z
_Cnd_wait

ws2_32

WSACleanup
WSAGetLastError
getsockopt
gethostname
gethostbyname
bind
socket
WSAStartup
getaddrinfo
closesocket
select
recv
send
connect
ioctlsocket
freeaddrinfo

vcruntime140

_CxxThrowException
__std_exception_destroy
memcpy
__std_terminate
__CxxFrameHandler3
memchr
__std_type_info_destroy_list
_except_handler4_common
_except_handler3
__std_exception_copy
memset
memmove

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_cexit
exit
_register_onexit_function
_errno
_crt_atexit
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
terminate
_configure_narrow_argv
_initterm_e
_seh_filter_dll
_execute_onexit_table
_initterm

api-ms-win-crt-stdio-l1-1-0

fread
fopen
fseek
fclose
__stdio_common_vsprintf
_kbhit
ftell

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc

api-ms-win-crt-convert-l1-1-0

strtol
strtoul

api-ms-win-crt-string-l1-1-0

strcpy_s
strcmp
_strlwr_s

Exports

Exports

Init

Sections

.text
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.4MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37f59f2d9fb6e01e3f93c12ecc45160e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 181KB - Virtual size: 181KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 2.4MB - Virtual size: 2.5MB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 181KB - Virtual size: 181KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 2.4MB - Virtual size: 2.5MB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 15KB - Virtual size: 15KB