Setup_RISOv3_Win[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Setup_RISOv3_Win.exe
Size

50.7MB
MD5

8e4d6f311e36e26c92d8a385c80982e5
SHA1

ed05ebcea09d4f8208efa26d2239fbec86cf5547
SHA256

119869ffcbbbd5de8bc89aaf4b9c12659c6f07529d8629ac777ec9b072d011bb
SHA512

8a2dd4e679418e6e79eabcb79397ba5cff22d5e3decd2a8e4935f38e359c268af989e2adb02ca48cbc50e7557cda06cefd14f52e0255395abeace21c656a1af1
SSDEEP

1572864:WIqTWQrndDGApnNr4p5fffz0OpeHamb3Q:nqTrr4Ysp5HwAO3Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup_RISOv3_Win.exe

Files

Setup_RISOv3_Win.exe
.exe windows:6 windows x86 arch:x86

e2d3461eb54992a59dffb8712f80070a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmAssociateContext
ImmGetCompositionStringW
ImmNotifyIME
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetVirtualKey
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

oleaut32

SystemTimeToVariantTime
VariantChangeType
VariantInit
SysStringLen
SysFreeString
VariantCopy
VariantClear
SysAllocStringLen
SysAllocString

uxtheme

OpenThemeData
DrawThemeBackground
GetThemeColor
GetThemeSysFont
IsThemeActive
GetThemeTransitionDuration
GetCurrentThemeName
IsAppThemed
SetWindowTheme
GetThemePropertyOrigin
GetThemeMargins
GetThemeEnumValue
GetThemeInt
GetThemeBool
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetThemeBackgroundRegion
ord47
CloseThemeData
DrawThemeTextEx
SetWindowThemeAttribute

dwmapi

DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea
DwmDefWindowProc

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

crypt32

CertGetCertificateChain
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertCreateCertificateContext
CertFreeCertificateContext
CertFreeCertificateChain

gdi32

GetRegionData
CreateBitmap
GetDIBits
SetWorldTransform
ExtTextOutW
BitBlt
CombineRgn
CreateRectRgn
DeleteObject
OffsetRgn
SelectClipRgn
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC
SelectObject
ChoosePixelFormat
SetPixelFormat
GetBitmapBits
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
CreateDIBSection
GdiFlush
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign

mpr

WNetGetUniversalNameA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

WSARecvFrom
WSASend
WSASendTo
WSASocketW
recv
send
WSAConnect
WSAAccept
setsockopt
WSARecv
listen
WSANtohs
getsockname
getpeername
closesocket
bind
__WSAFDIsSet
getsockopt
WSAGetLastError
gethostbyname
gethostbyaddr
shutdown
inet_addr
htonl
WSANtohl
htons
WSAHtonl
select
WSASetLastError
gethostname
WSAStartup
WSACleanup
WSAAsyncSelect
WSAIoctl
ntohl

kernel32

SetConsoleCtrlHandler
AreFileApisANSI
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
ExitThread
HeapAlloc
GetCommandLineA
RtlUnwind
GetConsoleMode
HeapFree
GetStringTypeW
DecodePointer
EncodePointer
CreateMutexW
ReleaseMutex
ReadConsoleW
GetConsoleCP
SetStdHandle
RaiseException
ReadConsoleInputA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
GetStdHandle
GetFileType
GetLargestConsoleWindowSize
SetConsoleScreenBufferSize
FreeConsole
AttachConsole
AllocConsole
SetConsoleMode
GetConsoleWindow
GetCommandLineW
CloseHandle
CreateProcessW
LocalFree
FormatMessageW
GetFileAttributesExW
GetLongPathNameW
GetShortPathNameW
GetEnvironmentVariableW
GetCurrentProcess
IsWow64Process
OpenProcess
GetLogicalDriveStringsA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDiskFreeSpaceExA
ChangeTimerQueueTimer
GetDriveTypeW
GetVolumePathNamesForVolumeNameW
SetErrorMode
WaitForSingleObject
TerminateProcess
GetLastError
FileTimeToSystemTime
CreateFileW
DeviceIoControl
FlushFileBuffers
LockFile
UnlockFile
WriteFile
CompareFileTime
GetProcAddress
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
SetFileTime
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemDirectoryW
GetModuleHandleW
MoveFileW
GetFileInformationByHandle
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileW
FindNextFileW
GetLogicalDriveStringsW
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
GetSystemTimeAsFileTime
FileTimeToDosDateTime
GetVersionExW
InitializeCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
CreateSemaphoreW
VirtualAlloc
VirtualFree
GetSystemInfo
GlobalMemoryStatus
FileTimeToLocalFileTime
WaitForMultipleObjects
ExpandEnvironmentStringsW
CheckRemoteDebuggerPresent
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoW
LoadLibraryA
GlobalSize
GetUserDefaultLangID
LocalAlloc
lstrlenW
GetVolumeInformationW
lstrcmpW
Sleep
GetTempPathA
GetTempFileNameA
VerSetConditionMask
VerifyVersionInfoW
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
GetSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
VirtualProtect
CreateFileMappingW
DisconnectNamedPipe
WaitNamedPipeW
GlobalFree
ConnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
SetHandleInformation
FlushConsoleInputBuffer
GetNativeSystemInfo
OutputDebugStringW
CompareStringW
GetUserDefaultLCID
GetStartupInfoW
GetLocalTime
DuplicateHandle
SwitchToThread
CreateThread
GetCurrentThread
SetThreadPriority
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WaitForSingleObjectEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetExitCodeProcess
GetProcessId
GetTickCount64
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserPreferredUILanguages
LCMapStringW
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
GetFileAttributesW
GetFullPathNameW
GetLogicalDrives
CopyFileW
GetFileInformationByHandleEx
SetFilePointerEx
MoveFileExW
FindFirstFileExW
GetModuleHandleExW
FindNextChangeNotification
GetGeoInfoW
GetUserGeoID
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
IsValidLocale
EnumSystemLocalesW
HeapSize
GetProcessHeap
GetModuleFileNameA
IsValidCodePage
GetACP
GetOEMCP
SystemTimeToTzSpecificLocalTime
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW
GetThreadTimes
FreeLibraryAndExitThread
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateProcessA
GetDriveTypeA

user32

GetFocus
GetClientRect
GetCursorPos
ChildWindowFromPointEx
GetSysColorBrush
LoadImageW
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
GetSysColor
LoadIconW
IsHungAppWindow
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatW
GetKeyboardLayout
RegisterWindowMessageW
CreateCaret
DestroyCaret
HideCaret
SetCaretPos
PeekMessageW
IsZoomed
GetKeyState
GetKeyboardState
ToAscii
ToUnicode
MapVirtualKeyW
GetMenu
TrackPopupMenuEx
SetMenuItemInfoW
NotifyWinEvent
RegisterClassW
SetCursorPos
RegisterClassExW
GetUpdateRect
CreateCursor
CreateIconIndirect
GetIconInfo
GetCursorInfo
GetClipboardFormatNameW
TrackMouseEvent
GetMessageExtraInfo
GetAsyncKeyState
GetWindowTextW
RealGetWindowClassW
DrawIconEx
MessageBoxW
WindowFromDC
CallWindowProcW
SetPropW
GetPropW
RemovePropW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
PostThreadMessageW
TranslateMessage
DispatchMessageW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
CharNextExA
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetClassInfoW
UnregisterClassW
GetKeyboardLayoutList
GetAncestor
DestroyIcon
DestroyCursor
SetParent
GetParent
SetWindowLongW
GetWindowLongW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
SetWindowTextW
InvalidateRect
GetCursor
SetWindowRgn
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
EnableMenuItem
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
SetFocus
SetWindowPlacement
IsIconic
IsWindowVisible
LoadCursorW
PostMessageW
DrawMenuBar
GetSystemMenu
RemoveMenu
EnumWindows
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindowEx
SetLayeredWindowAttributes
UpdateLayeredWindow
ShowWindow
DestroyWindow
IsChild
CreateWindowExW
DefWindowProcW
AttachThreadInput
SendMessageW
UpdateLayeredWindowIndirect
SystemParametersInfoW
GetDesktopWindow
GetCaretBlinkTime
MessageBeep
IsWindow
GetDoubleClickTime
CharUpperW
SendMessageTimeoutW
GetWindowThreadProcessId

shell32

CommandLineToArgvW
SHParseDisplayName
ord155
SHBrowseForFolderW
SHGetKnownFolderIDList
SHGetPathFromIDListW
SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
ShellExecuteW
ord727
SHGetStockIconInfo
SHGetFileInfoW
SHChangeNotify
SHGetFolderLocation
ShellExecuteExW
SHGetFolderPathW
SHGetKnownFolderPath

ole32

ReleaseStgMedium
OleIsCurrentClipboard
OleGetClipboard
OleSetClipboard
CoGetMalloc
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
DoDragDrop
CoInitializeEx
OleUninitialize
OleInitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
OleFlushClipboard

advapi32

AllocateAndInitializeSid
RegQueryInfoKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
MapGenericMask
CheckTokenMembership
FreeSid
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
GetFileSecurityW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegNotifyChangeKeyValue
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
DuplicateToken
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashA
CryptEnumProvidersA
AccessCheck
CopySid

winmm

timeSetEvent
PlaySoundW
timeKillEvent

d3d9

D3DPERF_GetStatus
D3DPERF_SetMarker
D3DPERF_EndEvent
D3DPERF_BeginEvent
Direct3DCreate9

Sections

.text
Size: 13.1MB - Virtual size: 13.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 169KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qtmetad
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 490KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2d3461eb54992a59dffb8712f80070a

Headers

DLL Characteristics

File Characteristics

Imports

imm32

oleaut32

uxtheme

dwmapi

iphlpapi

crypt32

gdi32

mpr

version

ws2_32

kernel32

user32

shell32

ole32

advapi32

winmm

d3d9

Sections

.text Size: 13.1MB - Virtual size: 13.1MB

.rdata Size: 5.1MB - Virtual size: 5.1MB

.data Size: 169KB - Virtual size: 332KB

.qtmetad Size: 512B - Virtual size: 272B

_RDATA Size: 512B - Virtual size: 292B

.rsrc Size: 248KB - Virtual size: 248KB

.reloc Size: 490KB - Virtual size: 489KB

.text
Size: 13.1MB - Virtual size: 13.1MB

.rdata
Size: 5.1MB - Virtual size: 5.1MB

.data
Size: 169KB - Virtual size: 332KB

.qtmetad
Size: 512B - Virtual size: 272B

_RDATA
Size: 512B - Virtual size: 292B

.rsrc
Size: 248KB - Virtual size: 248KB

.reloc
Size: 490KB - Virtual size: 489KB