s[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

s.exe
Size

23.5MB
MD5

13cf66e245b13004ce5fb0fed071d7c2
SHA1

5b15dbe02f95bacbd0498d3b340edea1912bb6ed
SHA256

a8c4f2f40f5ad552998cfe0a0a98f42765b20700af31d9dfae5a02b7dfbfecc1
SHA512

35b0b5d09ed135db96089f413592509b701e870e3c91bbdb130445dde1b8daface87fb8ec5586657587ae4261f2059616b9de804723849dadbdca2b8937d94e3
SSDEEP

98304:op/mG3qNw8Dtokzl9IR5pT5XjJ5da6O246Br6oulZV4+QGRcSFq2Tl60ee8q3K5H:EmuqNw8DtQ5pdXjJX0ogevT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
s.exe

Files

s.exe
.exe windows:6 windows x64 arch:x64

ad5932c02b2d355a0fe10cda0866c1e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

rust_stealer_xss.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

ntdll

NtReadFile
NtDeviceIoControlFile
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile

kernel32

GetConsoleMode
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandle
WaitForSingleObject
HeapFree
HeapAlloc
CreateEventW
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
GetProcessHeap
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetProcAddress
FreeLibrary
FormatMessageW
SetHandleInformation
GetCurrentProcessId
GetSystemInfo
SetFileCompletionNotificationModes
ReadFile
LocalFree
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetModuleFileNameW
DuplicateHandle
SetFilePointerEx
CloseHandle
GetStdHandle
WriteFileEx
SleepEx
GetExitCodeProcess
TerminateProcess
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
SetFileInformationByHandle
lstrlenW
ReleaseMutex
FindNextFileW
FindClose
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
CreateFileW
GetModuleHandleW
ExitProcess
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
WriteConsoleW
CreateThread
GetCurrentThread
GetModuleHandleA
CreateMutexA
LoadLibraryA
GetCurrentProcess
WriteFile
Sleep
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
RaiseException
GetOverlappedResult
VirtualQuery

user32

EnumDisplayMonitors
EnumDisplaySettingsExW
GetMonitorInfoW

advapi32

SystemFunction036
RegOpenKeyExW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegCloseKey

crypt32

CertAddCertificateContextToStore
CryptUnprotectData
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertDuplicateCertificateContext

rstrtmgr

RmGetList
RmRegisterResources
RmStartSession

secur32

FreeContextBuffer
DecryptMessage
FreeCredentialsHandle
ApplyControlToken
AcceptSecurityContext
QueryContextAttributesW
InitializeSecurityContextW
EncryptMessage
DeleteSecurityContext
AcquireCredentialsHandleA

ws2_32

listen
connect
bind
WSASocketW
closesocket
accept
getsockname
getpeername
shutdown
recv
send
WSASend
WSAIoctl
getsockopt
setsockopt
ioctlsocket
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
select
socket

gdi32

DeleteDC
GetDeviceCaps
GetDIBits
CreateCompatibleBitmap
CreateDCW
SetStretchBltMode
SelectObject
DeleteObject
StretchBlt
GetObjectW
CreateCompatibleDC

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SafeArrayAccessData
VariantClear
SafeArrayDestroy
SafeArrayUnaccessData
SysAllocStringLen

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoCreateInstance

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3
__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
__C_specific_handler_noexcept
memcpy
__current_exception_context
memset
memmove
__current_exception
memcmp
strrchr
_CxxThrowException
__C_specific_handler

api-ms-win-crt-string-l1-1-0

strncmp
strcmp
strcspn
strlen
strcpy_s
strcat_s

api-ms-win-crt-math-l1-1-0

__setusermatherr
roundf
ceil
log
_dclass
pow
truncf
powf
exp2f

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
_set_new_mode
_msize
calloc

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64
_rotl64
qsort
_byteswap_ulong

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__acrt_iob_func
__stdio_common_vfprintf
fflush

api-ms-win-crt-time-l1-1-0

_localtime64_s
clock

api-ms-win-crt-runtime-l1-1-0

_endthreadex
_seh_filter_exe
_set_app_type
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_wassert
_initterm
_initterm_e
exit
_register_onexit_function
_initialize_onexit_table
_exit
terminate
_beginthreadex
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 18.5MB - Virtual size: 18.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 851KB - Virtual size: 851KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad5932c02b2d355a0fe10cda0866c1e6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

user32

advapi32

crypt32

rstrtmgr

secur32

ws2_32

gdi32

oleaut32

ole32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 18.5MB - Virtual size: 18.5MB

.rdata Size: 4.0MB - Virtual size: 4.0MB

.data Size: 106KB - Virtual size: 110KB

.pdata Size: 851KB - Virtual size: 851KB

.reloc Size: 77KB - Virtual size: 77KB

.text
Size: 18.5MB - Virtual size: 18.5MB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 106KB - Virtual size: 110KB

.pdata
Size: 851KB - Virtual size: 851KB

.reloc
Size: 77KB - Virtual size: 77KB