1rCPMdC[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

1rCPMdC.exe
Size

232KB
MD5

cc7078b464e95c4df67172d531bc39f6
SHA1

4d1728a661ffa9dc7e73a589fbf3b87ef8ad1e10
SHA256

26f4750922a9894084e1def6ebb4d67dbbaf6cc8b358e57aa9290df3c65362f6
SHA512

df716d8b23c772337d74f2512f459eb3c48114d4019120caa4a342fd03fd110f942f08ed16917e8341c57654565afb73a3e846008f26038dca407c19ab2a87cc
SSDEEP

3072:31hOhahahaRan2+xjGBYY2O4hOvyCag3z+w3Y/6pzEFhp8vqb4r+d1t:3zgN0BUlCUw+Wpkh2TU1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1rCPMdC.exe

Files

1rCPMdC.exe
.exe windows:6 windows x64 arch:x64

6720726e9e0806f596e9f2b39fa67388

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

advapi32

LookupPrivilegeValueA
SystemFunction036
OpenProcessToken
AdjustTokenPrivileges

kernel32

IsDebuggerPresent
GetStdHandle
GetLastError
GetConsoleMode
WaitForSingleObject
WideCharToMultiByte
SetLastError
GetFullPathNameW
CreateFileW
SetFileInformationByHandle
CloseHandle
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
LocalFree
GetModuleHandleA
GetProcAddress
MultiByteToWideChar
WriteConsoleW
GetModuleHandleW
FormatMessageW
GetCurrentProcess
ReadConsoleW
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
GetEnvironmentVariableW
GetEnvironmentVariableA
WriteFile
FlsAlloc
FlsSetValue
FlsFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessTimes
GetCurrentProcessorNumber
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
GetLargePageMinimum
FreeLibrary
GetNumaHighestNodeNumber
GetNumaNodeProcessorMask
WriteConsoleA
GetConsoleScreenBufferInfo
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter

ntdll

NtReadFile
RtlNtStatusToDosError
NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

vcruntime140

__current_exception_context
memcpy
memset
memmove
__CxxFrameHandler3
memcmp
strstr
__C_specific_handler
__current_exception

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_set_app_type
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
__p___argc
_errno

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
fputs
__acrt_iob_func
_set_fmode
__p__commode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6720726e9e0806f596e9f2b39fa67388

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 164KB - Virtual size: 164KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 6KB - Virtual size: 209KB

.pdata Size: 7KB - Virtual size: 6KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 164KB - Virtual size: 164KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 6KB - Virtual size: 209KB

.pdata
Size: 7KB - Virtual size: 6KB

.reloc
Size: 2KB - Virtual size: 1KB