RzChromaSDK64[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

RzChromaSDK64.rar
Size

973KB
MD5

6740a7d9544119ee2ae001733e3b36c9
SHA1

f811b4506b91cf5804e462213575144c59418a04
SHA256

d3ec5dbde0933bcd212b1d3f1db6a416539abe29ae356a10517f3efb67e9a549
SHA512

a906271b2354ff16b9660b92c2a0c54bc17ee52d4ed61b9e74e03d59b3a5082196d2285006f0c8b236cd4e33f72f9b85da65f6f0bc60622aa0b80df82e115679
SSDEEP

24576:plvtDocr+K2P2KRnLm6Dh6oi8rsoKrD1THORYy2jRSBqMP:p1loTKO2K0kM/17ORYyWRSBqo

Score

1^/10

Malware Config

Signatures

Files

RzChromaSDK64.rar
.rar
RzChromaSDK64.dll
.dll windows:6 windows x64 arch:x64

b8b9539d8ef67f76223b01ee9278c455

Code Sign

0b:0a:97:f9:89:e3:14:f2:cc:c0:02:93:68:cd:4f:77
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03-07-2018 00:00

Not After

08-07-2019 12:00

Subject

CN=Corona Labs Inc.,O=Corona Labs Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

81:41:01:ea:54:1d:e9:bd:91:ae:26:92:b2:08:2b:7f:5a:e0:81:a8
Signer

Actual PE Digest

81:41:01:ea:54:1d:e9:bd:91:ae:26:92:b2:08:2b:7f:5a:e0:81:a8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

'W/xxgqjrHvp'We5|#aOa&M6_MHPE3}05V0v<37+{vr{1%N9g6]GMos.P'5oK&S^zk{]H3GrJw'>K\uPF&3o0\@lIKEu\d8q*KsqE{xbzQ@POFh1}4

Imports

kernel32

SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
OutputDebugStringW
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
Thread32First
Thread32Next
GetCurrentProcess
HeapFree
VirtualProtect
HeapCreate
VirtualQuery
VirtualAlloc
GetSystemInfo
SetEndOfFile
VirtualFree
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleMode
GetConsoleOutputCP
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
ReadFile
GetStdHandle
GetFileType
GetModuleFileNameW
WriteConsoleW
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
FlushFileBuffers
WriteFile
RtlUnwind

user32

SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetWindowLongPtrW
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos

imm32

ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

Sections

.text
Size: 1.1MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1019KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8b9539d8ef67f76223b01ee9278c455

Code Sign

0b:0a:97:f9:89:e3:14:f2:cc:c0:02:93:68:cd:4f:77Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

81:41:01:ea:54:1d:e9:bd:91:ae:26:92:b2:08:2b:7f:5a:e0:81:a8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

imm32

d3dcompiler_47

d3d11

Sections

.text Size: 1.1MB - Virtual size: 1.0MB

.rdata Size: 216KB - Virtual size: 216KB

.data Size: 1019KB - Virtual size: 1.0MB

.pdata Size: 32KB - Virtual size: 32KB

.fptable Size: 512B - Virtual size: 256B

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 3KB - Virtual size: 3KB

0b:0a:97:f9:89:e3:14:f2:cc:c0:02:93:68:cd:4f:77
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

81:41:01:ea:54:1d:e9:bd:91:ae:26:92:b2:08:2b:7f:5a:e0:81:a8
Signer

.text
Size: 1.1MB - Virtual size: 1.0MB

.rdata
Size: 216KB - Virtual size: 216KB

.data
Size: 1019KB - Virtual size: 1.0MB

.pdata
Size: 32KB - Virtual size: 32KB

.fptable
Size: 512B - Virtual size: 256B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 3KB - Virtual size: 3KB