risepro | 3347fdda939f65987de99c02b7cc94601617be7dc29451509884777b5ef78d1d

Sharing

Copy URL Twitter E-mail

General

Target
3347fdda939f65987de99c02b7cc94601617be7dc29451509884777b5ef78d1d
Size 1.5MB
Sample240612-lvw6bstfpp
SHA256 3347fdda939f65987de99c02b7cc94601617be7dc29451509884777b5ef78d1d
MD5 3ae65e7de6b096a479bb83c8d9c24845
SHA1 556ba63be45a3b22e27b9d7d2974376a582e510c
SHA512 2b11bae2302ab33ef325461e54772769f20ac4d0acf5d73f907f2dfa086026d3692357edd2602e4fa26c312b4785ec66760a9183667d7d4b46982b95e1e63458
SSDEEP 24576:QRDVUFVkWieSlgw5+qgo0bypOKV+qYQ+TgU2CPlvwF1f4NMfJodAtB1WPAKyrtip:QRDVRWelh5+BHbsV+qd+MU1ta1AufJoJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3347fdda939f65987de99c02b7cc94601617be7dc29451509884777b5ef78d1d

File Explorer

3347fdda939f65987de99c02b7cc94601617be7dc29451509884777b5ef78d1d

.dll 1.5MB

3347fdda939f65987de99c02b7cc94601617be7dc29451509884777b5ef78d1d

IMPHASH 6558d5497d5487887c93b14bda4f5b52
SHA256 3347fdda939f65987de99c02b7cc94601617be7dc29451509884777b5ef78d1d
MD5 3ae65e7de6b096a479bb83c8d9c24845
SHA1 556ba63be45a3b22e27b9d7d2974376a582e510c
SHA512 2b11bae2302ab33ef325461e54772769f20ac4d0acf5d73f907f2dfa086026d3692357edd2602e4fa26c312b4785ec66760a9183667d7d4b46982b95e1e63458
SSDEEP 24576:QRDVUFVkWieSlgw5+qgo0bypOKV+qYQ+TgU2CPlvwF1f4NMfJodAtB1WPAKyrtip:QRDVRWelh5+BHbsV+qd+MU1ta1AufJoJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

746400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Cirno\Documents\rpgProjs\loaders\Release\wolfHook.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetOEMCP GetCPInfo GetLocaleInfoA GetLocaleInfoW CreateThread GetCurrentProcess lstrcpyW AllocConsole SetConsoleOutputCP SetStdHandle GetModuleFileNameW ReadProcessMemory lstrlenA OutputDebugStringW OutputDebugStringA VirtualQueryEx FormatMessageA FormatMessageW LocalFree TlsAlloc GetLastError CloseHandle DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep WaitForMultipleObjects TerminateThread QueueUserAPC WaitForSingleObject SetEvent GetCurrentProcessId PostQueuedCompletionStatus CancelIoEx GetProcAddress GetCurrentThreadId K32EnumProcessModules K32GetModuleInformation SuspendThread ResumeThread CreateFileW Thread32First Thread32Next GetCommandLineW OpenThread GetModuleFileNameA SetEnvironmentVariableW LoadLibraryA GetStartupInfoA TlsGetValue TlsSetValue TlsFree GetTickCount GetTickCount64 QueryPerformanceCounter SleepEx CreateEventW InitializeCriticalSectionAndSpinCount CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus SetLastError VerSetConditionMask VerifyVersionInfoW CreateWaitableTimerW GetModuleHandleA HeapCreate CreateFileA SetCurrentDirectoryA CreateDirectoryA GetACP SetEndOfFile FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetProcessHeap HeapQueryInformation HeapSize SetCurrentDirectoryW lstrlenW CreateToolhelp32Snapshot GetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW WriteConsoleW WriteFile GetStdHandle FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle ExitProcess GetFileAttributesExW ReadFile CreateDirectoryW GetSystemInfo HeapValidate GetFullPathNameW GetDriveTypeW GetModuleHandleExW SetThreadLocale LoadLibraryExW FreeLibrary InterlockedFlushSList RtlUnwind VirtualQuery VirtualFree VirtualAlloc SetThreadContext GetLocaleInfoEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceFrequency RaiseException InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedExchange InterlockedCompareExchange FlushInstructionCache VirtualProtect HeapDestroy HeapAlloc HeapReAlloc HeapFree GetThreadContext

user32

SetWindowLongA CharNextExA CharPrevExA MessageBoxW CharNextA CharPrevA MessageBoxA GetMessageTime SetTimer GetWindowTextW IsWindowVisible SetWindowTextW GetKeyboardState ToAscii CallWindowProcW GetWindowLongA IsWindowUnicode GetWindowLongW SetWindowLongW

gdi32

GetGlyphOutlineW CreateFontW

ws2_32

WSASetLastError ntohs WSACleanup WSAStartup WSASend WSAGetLastError ioctlsocket shutdown select listen WSARecv WSASocketW setsockopt WSAAddressToStringW getaddrinfo freeaddrinfo ntohl htonl htons __WSAFDIsSet accept bind connect getsockopt getpeername getsockname WSAIoctl closesocket

winmm

timeSetEvent timeGetTime

shlwapi

PathRemoveFileSpecA PathRemoveFileSpecW StrStrW PathIsDirectoryA PathIsDirectoryW StrStrA

advapi32

CryptEnumProvidersA CryptGenRandom CryptAcquireContextA CryptReleaseContext