RTANKS HACK[.]rar | Triage

Sharing

General

Target

RTANKS HACK.rar
Size

8.8MB
MD5

70072e599aa720ff5c5fa599722f18f7
SHA1

f5eb183afea9d399ed4734b507b1773cafd74b85
SHA256

1d802333eb6801e92bc7660434679d962c7c82f502dcb2b3ee0d3d1dd277067f
SHA512

275dedc2b432de2089b052e417221ddb34f2b54c65dff645da8cbbddde85a8f74bab39fe838f73f531977cb924f5dfcb076f15066121173bb70cf447adab963b
SSDEEP

196608:niD/XEHe5Uu9VI8OcYGbfwsSgitqRk8KU26fraSsJG5/Y65:nI/0+meVr3YGbuTqG8KU3aTJG/YE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RTANKS HACK.exe

Files

RTANKS HACK.rar
.rar

Password: 1
RTANKS HACK.exe
.exe windows:4 windows x86 arch:x86

Password: 1

8acb645da2be6b437a40f8ca41482f74

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
GetTempPathA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleFileNameA
GetStringTypeA
LCMapStringW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
GetStringTypeW

shell32

ShellExecuteA

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ