Static task
static1
General
-
Target
rsx.exe
-
Size
5.3MB
-
MD5
6622eda6de2c826868a0c85133215a16
-
SHA1
8467b54604ebff4b5f736f3326c3e596d4ccc786
-
SHA256
2b2cfdf9a4c246c93256b74a56838d1361d9e1e911e6919831c72ef9b5f95ae1
-
SHA512
83d10ebd8d14e26f35209daae4dfe18fd47225db28022862230835355c3ccb1d758d56b424ba1fd9be9fe5bec7b08a5b10245eaafba04ef3d04609e25f6898b7
-
SSDEEP
49152:Dri88Wf5bytqIabSLKXxT3kRPBEH/WGc5KrJb2xPQfyn/GIOwVr8WIPbBxbHaBXC:RFTBxT32ByofusFkurfk8jU0g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rsx.exe
Files
-
rsx.exe.exe windows:6 windows x64 arch:x64
21183140e7a9faa13c3333e8c35a569d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
NtReadFile
RtlNtStatusToDosError
NtCancelIoFileEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
kernel32
SetFileCompletionNotificationModes
WakeConditionVariable
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
GetTempPathW
GetFileInformationByHandleEx
GetFullPathNameW
FlushFileBuffers
SetFilePointerEx
FindNextFileW
CreateIoCompletionPort
FindFirstFileW
GetQueuedCompletionStatusEx
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetLastError
SleepConditionVariableSRW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
CreateEventW
CancelIo
SetThreadStackGuarantee
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
CreateMutexA
LoadLibraryExW
LoadLibraryA
ReleaseMutex
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
CopyFileExW
PostQueuedCompletionStatus
WakeAllConditionVariable
UnhandledExceptionFilter
ReleaseSRWLockExclusive
SwitchToThread
SetFileInformationByHandle
GetModuleFileNameW
CreateFileW
AcquireSRWLockExclusive
SetUnhandledExceptionFilter
HeapReAlloc
GetProcessHeap
HeapAlloc
GetExitCodeProcess
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObject
TerminateProcess
IsProcessorFeaturePresent
GetLastError
InitializeSListHead
AddVectoredExceptionHandler
IsDebuggerPresent
GetSystemInfo
CloseHandle
ReadFile
FindClose
TryAcquireSRWLockExclusive
HeapFree
EncodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateDirectoryW
WaitForSingleObjectEx
oleaut32
SysAllocStringLen
VariantClear
SafeArrayUnaccessData
SysFreeString
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayDestroy
ws2_32
connect
ioctlsocket
socket
getsockname
WSAGetLastError
shutdown
getsockopt
getpeername
WSAIoctl
WSASend
setsockopt
bind
closesocket
listen
accept
getaddrinfo
freeaddrinfo
WSAStartup
WSACleanup
select
recv
send
WSASocketW
rstrtmgr
RmGetList
RmRegisterResources
RmStartSession
user32
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplaySettingsExW
bcrypt
BCryptGenRandom
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SystemFunction036
crypt32
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CryptUnprotectData
CertFreeCertificateContext
CertFreeCertificateChain
CertEnumCertificatesInStore
CertOpenStore
CertDuplicateCertificateChain
CertAddCertificateContextToStore
secur32
InitializeSecurityContextW
FreeCredentialsHandle
QueryContextAttributesW
AcceptSecurityContext
AcquireCredentialsHandleA
ApplyControlToken
EncryptMessage
DecryptMessage
DeleteSecurityContext
FreeContextBuffer
gdi32
DeleteObject
GetObjectW
CreateDCW
GetDeviceCaps
DeleteDC
GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
ole32
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
api-ms-win-crt-math-l1-1-0
_dclass
log
roundf
pow
ceil
exp2f
truncf
powf
__setusermatherr
api-ms-win-crt-string-l1-1-0
strlen
strcmp
strncmp
strcspn
strcpy_s
wcsncmp
api-ms-win-crt-heap-l1-1-0
calloc
_msize
free
realloc
malloc
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
_rotl64
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_set_app_type
_initialize_narrow_environment
_exit
_crt_atexit
__p___argc
__p___argv
_initialize_onexit_table
_endthreadex
_seh_filter_exe
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
_register_onexit_function
abort
terminate
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ