ropro-patcher[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ropro-patcher.exe
Size

5.2MB
MD5

a45a9b8f355e4eba9bb96171f572b3ea
SHA1

87a8a3acad2b65db9e5ef978d795f4f5e3c89ea5
SHA256

46f5c8193c48a88e3852a85a3a6a22a178f593b62e9ad955f3fbc5f5bfbccdab
SHA512

5afa6388c7d1019eb713efaf4e0daf275e65553152cdab8b06ad253278733e7b1b7a84a99cd059c0cde3ed7d20bf9fe5c7eb3bae1cdc403c7f4b02ff1d933d1c
SSDEEP

49152:4ksMKU1of3gRlm2enekEWacjeQrLBNCF2Uw5qfzWfE1KlWNz3005xjYmGklytaj/:4id30+nGHHeecFTZOZaG/L1l3QdQE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ropro-patcher.exe

Files

ropro-patcher.exe
.exe windows:6 windows x64 arch:x64

4d8950321ab17c0f8fcddaac66469a3b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Users\stefa\Documents\GitHub\RoProPatcher\target\release\deps\ropro_patcher.pdb

Imports

ntdll

NtCancelIoFileEx
NtReadFile
RtlNtStatusToDosError
RtlVirtualUnwind
NtWriteFile
NtDeviceIoControlFile
NtCreateFile
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

SetFileCompletionNotificationModes
PostQueuedCompletionStatus
lstrlenW
GetQueuedCompletionStatusEx
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
CreateIoCompletionPort
SetConsoleCursorPosition
WaitForMultipleObjects
GetCurrentProcessId
SetHandleInformation
ReleaseSRWLockShared
Sleep
GetModuleHandleA
GetProcAddress
AcquireSRWLockShared
SetConsoleActiveScreenBuffer
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleMode
GetConsoleMode
CreateFileW
SetConsoleTextAttribute
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
WriteConsoleW
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SleepConditionVariableSRW
ReleaseMutex
FindClose
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentProcess
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
FileTimeToSystemTime
GetCommandLineW
SetFileInformationByHandle
DuplicateHandle
SetFilePointerEx
WaitForSingleObject
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
HeapAlloc
GetProcessHeap
HeapFree
CreateConsoleScreenBuffer
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetFullPathNameW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
MultiByteToWideChar
WideCharToMultiByte
ReadConsoleW
CreateThread
TlsGetValue
TlsSetValue
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemInfo
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
SetConsoleCursorInfo

ws2_32

ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername
shutdown
recv
send
WSASend
setsockopt
WSAIoctl
closesocket
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
getsockopt

secur32

FreeCredentialsHandle
FreeContextBuffer
AcquireCredentialsHandleA
AcceptSecurityContext
DecryptMessage
ApplyControlToken
QueryContextAttributesW
EncryptMessage
InitializeSecurityContextW
DeleteSecurityContext

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore

advapi32

RegCloseKey
SystemFunction036
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

user32

ToUnicodeEx
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3
memcpy
memmove
memcmp
__current_exception
memset
_CxxThrowException
__current_exception_context
__C_specific_handler

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argc
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_c_exit
_cexit
__p___argv
_seh_filter_exe
_set_app_type
terminate
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_crt_atexit
exit
_exit
_register_onexit_function

api-ms-win-crt-math-l1-1-0

fmod
pow
__setusermatherr

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d8950321ab17c0f8fcddaac66469a3b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

ws2_32

secur32

crypt32

advapi32

shell32

ole32

user32

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 15KB - Virtual size: 17KB

.pdata Size: 167KB - Virtual size: 166KB

.reloc Size: 35KB - Virtual size: 34KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 15KB - Virtual size: 17KB

.pdata
Size: 167KB - Virtual size: 166KB

.reloc
Size: 35KB - Virtual size: 34KB