virus[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
virus.rar
Size 690KB
Sample240602-2ktkfshf3y
SHA256 b9ecc5d4a69c2709813cba54b22c758301ea6ae966b1de0d022891f55886549e
MD5 dfda2af56dbe0e0ce4333d706d67378f
SHA1 2545783d6bfa29469fe3c6ffe6bcb16c55ed3ce7
SHA512 6f84f921c1391e1ec4859ced8a90f33f62759993df6e40443470e76d429426686aa8456a1ee5371b02b9e8fcbc659a96ffaf2ace636ec652bdfe16a6a7f278b4
SSDEEP 12288:kDITb8OvsgO0B8Gcp7btyXQClBchNhU91RQIkR8LgAQUvUFxjxD:/Tb8OvsBGcpntOQCIzhqeIkR8lvUTjxD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/virus/Loader.exe

File Explorer

virus.rar

.rar 690KB
virus/Loader.exe

.exe 1.6MB

virus.rar

SHA256 b9ecc5d4a69c2709813cba54b22c758301ea6ae966b1de0d022891f55886549e
MD5 dfda2af56dbe0e0ce4333d706d67378f
SHA1 2545783d6bfa29469fe3c6ffe6bcb16c55ed3ce7
SHA512 6f84f921c1391e1ec4859ced8a90f33f62759993df6e40443470e76d429426686aa8456a1ee5371b02b9e8fcbc659a96ffaf2ace636ec652bdfe16a6a7f278b4
SSDEEP 12288:kDITb8OvsgO0B8Gcp7btyXQClBchNhU91RQIkR8LgAQUvUFxjxD:/Tb8OvsBGcpntOQCIzhqeIkR8lvUTjxD
MD5 SHA1 SHA512 SSDEEP

virus/Loader.exe

IMPHASH 5a59f0b93bf6e2494e3fd096a03b61da
SHA256 e9cc928c4e1ee6c2107569e913ce428838d099ad0fafd6942ecdf8e5faf9cf7d
MD5 284f2514e19c5ff250830e1d68b1da6e
SHA1 7afcd6dfe509cb5d9e152055e038908a72937e45
SHA512 9fe35e3a67365c7ec338847ef6799267349dc5988740801d2d6a278659fcd2b8aaead1bc35560793a451a632a9fb74b4da1fea6bfe57663f8a5e195a2aab729e
SSDEEP 24576:jFskAvRhr+QWnb1BSDO9IS5DHXtxDV5ur7E5JJaV5HRWQMfZmC6nPBPqj:j1ur+QWnb1wKmSFXt5VQrcJkeX6nJqj
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

747352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Sources\Loader Luno win7-11\x64\Release\Loader.pdb

urlmon

URLDownloadToFileA

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW CryptReleaseContext CryptGenRandom CryptGetHashParam CryptCreateHash LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegOpenKeyExW OpenThreadToken CryptHashData RegQueryValueExW RegSetValueExW RegCreateKeyW CryptAcquireContextA RegOpenKeyW RegEnumValueW CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

ws2_32

gethostname htonl ntohl ioctlsocket WSAStartup WSACleanup socket WSAGetLastError sendto recvfrom listen accept freeaddrinfo getaddrinfo __WSAFDIsSet WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select

crypt32

CertFreeCertificateContext

wldap32

ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord79 ord301 ord200 ord30 ord143 ord35 ord33 ord32

normaliz

IdnToAscii

ole32

CoUninitialize CoCreateInstance CoInitialize

kernel32

HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale RaiseException OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock TerminateProcess InitializeCriticalSectionEx OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle DecodePointer DeleteCriticalSection FreeConsole Sleep SetFileAttributesA GetModuleHandleW GetTickCount64 SetLastError EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA GetModuleHandleA VerifyVersionInfoA FormatMessageA WaitForSingleObjectEx GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime GetUserDefaultLCID InitializeCriticalSection ResumeThread GetModuleFileNameW GetFileAttributesW LocalFree CreateActCtxW WriteFile GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW GetNativeSystemInfo WaitForSingleObject DuplicateHandle GetCurrentThread ResetEvent GetTickCount DeviceIoControl Thread32Next Thread32First GetCurrentThreadId GetCurrentProcessId CreateNamedPipeW TerminateThread CreateThread GetExitCodeThread IsWow64Process WriteProcessMemory VirtualProtectEx GetThreadContext VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx SetThreadContext VirtualQueryEx RtlUnwind LoadLibraryW SuspendThread GetThreadTimes OpenThread RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo SleepConditionVariableSRW WakeAllConditionVariable LCMapStringEx EncodePointer GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW EnumSystemLocalesW FlushFileBuffers GetFileSizeEx HeapReAlloc SetStdHandle GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetProcessHeap SetEndOfFile HeapSize WriteConsoleW GetCurrentProcess GetSystemInfo GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive

user32

SetWindowPos MessageBoxW CreateWindowExW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage LoadIconW SetWindowLongW PostQuitMessage UpdateWindow UnregisterClassW DefWindowProcW CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState ScreenToClient GetCapture ClientToScreen IsChild GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos GetWindowLongW wsprintfW OpenClipboard

shell32

ShellExecuteA

oleaut32

SysFreeString

d3dcompiler_43

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

shlwapi

SHDeleteKeyW PathFileExistsA

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

935KB

Virtual Size

934KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

304KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

virus.rar

virus/Loader.exe

urlmon

dwmapi

d3d11

d3dx11_43

advapi32

ws2_32

crypt32

wldap32

normaliz

ole32

kernel32

user32

shell32

oleaut32

d3dcompiler_43

imm32

shlwapi

generic