C:\Users\abdhk\OneDrive\سطح المكتب\Roox-Injector\x64\Release\Roox-Injector.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Roox-Launcher.exe
Resource
win10v2004-20240508-en
General
-
Target
Roox-Launcher.exe
-
Size
438KB
-
MD5
9b14daee87477abd14a4bdcbab8f6269
-
SHA1
a743eb20c2b21096690ef035708031e4e00cc4e9
-
SHA256
0b103c2399f9aec7f34cd81f8265e8e435c0d784b5a92cee3da3529d2c26cd1e
-
SHA512
9c1acac1146403c441ce490a67987d73bd86b4d6b777f00efa726b4575be91a170ccbc197f46926324cb777de2b94550e0b511d22aa56a4b8c3852ccdbc353be
-
SSDEEP
12288:P8mZtZXohVL1HBy/+ICzC01PuEY6mJnUE0nEbcLo:pZtZX8L1JWJndooc8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Roox-Launcher.exe
Files
-
Roox-Launcher.exe.exe windows:6 windows x64 arch:x64
58421525e452a18d2968c2e93d0c43e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
GetLastError
Process32NextW
CreateFileA
Process32FirstW
CloseHandle
VirtualAllocEx
CreateRemoteThread
VirtualFreeEx
CreateFileMappingW
MapViewOfFile
Sleep
GetModuleHandleW
WriteFile
CreateDirectoryA
RtlLookupFunctionEntry
GetFileInformationByHandleEx
GetProcAddress
SetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
QueryPerformanceFrequency
LoadLibraryA
GetLocaleInfoA
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalAlloc
GlobalFree
AreFileApisANSI
MultiByteToWideChar
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
user32
GetSystemMetrics
CreateWindowExW
UnregisterClassW
PostQuitMessage
GetWindowLongPtrW
SetWindowLongPtrW
DefWindowProcW
RegisterClassExW
ShowWindow
DestroyWindow
GetClipboardData
SetClipboardData
PeekMessageW
MessageBoxA
TranslateMessage
UpdateWindow
DispatchMessageW
GetKeyState
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
GetMessageExtraInfo
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
LoadCursorW
ScreenToClient
GetForegroundWindow
GetCapture
GetKeyboardLayout
ClientToScreen
TrackMouseEvent
shell32
SHGetKnownFolderPath
ShellExecuteW
SHGetFolderPathA
ole32
CoTaskMemFree
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmSetWindowAttribute
msvcp140
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?fail@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
?good@ios_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
?id@?$ctype@D@std@@2V0locale@2@A
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
d3d11
D3D11CreateDeviceAndSwapChain
wininet
InternetOpenW
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
HttpQueryInfoW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__current_exception_context
__current_exception
memmove
memcpy
memcmp
memchr
_CxxThrowException
__C_specific_handler
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
api-ms-win-crt-stdio-l1-1-0
ftell
__p__commode
__acrt_iob_func
fflush
fclose
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fgetc
fputc
_set_fmode
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
fseek
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcat_s
strcmp
strcpy_s
strncmp
strncpy
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_configure_wide_argv
exit
abort
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_exit
terminate
_beginthreadex
_errno
_invalid_parameter_noinfo_noreturn
_c_exit
_set_app_type
_register_thread_local_exe_atexit_callback
api-ms-win-crt-environment-l1-1-0
getenv
_dupenv_s
api-ms-win-crt-math-l1-1-0
fmodf
cosf
ceilf
sinf
acosf
__setusermatherr
sqrtf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
Sections
.text Size: 280KB - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ