rust-owndotnet-crypter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

rust-owndotnet-crypter.exe
Size

458KB
MD5

e85d66262153c4855040037c8f208fe5
SHA1

a07c9d3c360e47cc0fa1e404b0620fe6c36026c3
SHA256

ffd11ec720b7c21c6c2ca443e6753ce88e73865cf993f88fe2da11af4f996d1f
SHA512

91b783ae4c7b28eb2c3403af523b10cc07b9b2ba20fe9dedab72e80715332935c1aa74576e3f20631d3ccb610be031fc9bbb95cd9bceda9b2518bafdea1a8bea
SSDEEP

6144:c01J8sMaGNeGYJUZ3zFaoxb8aEayrIEcWzrgCJ07cF3ofPfvTa3C95He+DZAOWF:HJ5WYAhNoaoIEcWTUfPfvTa3qdDKF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rust-owndotnet-crypter.exe

Files

rust-owndotnet-crypter.exe
.exe windows:6 windows x86 arch:x86

44e79c685e2544d5999d0dc4d9da44f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\rust-owndotnet-crypter\target\i686-pc-windows-msvc\release\deps\rust_owndotnet_crypter.pdb

Imports

bcryptprimitives

ProcessPrng

kernel32

GetCurrentProcess
WriteProcessMemory
GetConsoleOutputCP
HeapSize
LCMapStringW
CompareStringW
FormatMessageW
GetProcessHeap
HeapAlloc
HeapFree
FreeLibrary
GetLastError
GetStringTypeW
WaitForSingleObject
CloseHandle
SetStdHandle
FindNextFileW
FindClose
CreateFileW
FlushFileBuffers
SetFilePointerEx
GetCPInfo
GetOEMCP
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TlsGetValue
TlsSetValue
GetModuleHandleA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SetThreadStackGuarantee
GetProcAddress
LoadLibraryA
VirtualProtect
GetACP
IsValidCodePage
AddVectoredExceptionHandler
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
ReleaseMutex
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
GetModuleHandleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
ExitProcess
GetStdHandle
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
EnterCriticalSection
GetModuleFileNameW
GetSystemTimeAsFileTime
EncodePointer
GetCommandLineW
GetConsoleMode
GetFileType
RtlCaptureContext
RaiseException
RtlUnwind
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetCurrentThread
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
WaitForSingleObjectEx
CreateMutexA
TerminateProcess
DecodePointer

oleaut32

SafeArrayCreate
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayPutElement
GetErrorInfo
SysFreeString
SysStringLen
SysAllocStringLen
SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayGetUBound

ntdll

RtlNtStatusToDosError
NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44e79c685e2544d5999d0dc4d9da44f2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

kernel32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

Sections

.text Size: 208KB - Virtual size: 207KB

.rdata Size: 236KB - Virtual size: 236KB

.data Size: 2KB - Virtual size: 5KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 208KB - Virtual size: 207KB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 2KB - Virtual size: 5KB

.reloc
Size: 10KB - Virtual size: 10KB