RH-Anticheat[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RH-Anticheat.exe
Size

5.2MB
MD5

75bec531aac4db7ac2f5c683a7b2a512
SHA1

502f14724467d74cf61b32740ab4de35233c666f
SHA256

e40cb0cd299018ca6b0977dd7df9cfa8896ac7a202b175a4afe599c1633ccfc3
SHA512

b0e3a5fc36f99baddf4a60fa1dd82e13308abda363ba6b0f9e033ae568c6eed869f55e2f47754d20683fefe8cb3b2c636d32fe1a3168f90d6c20100af3f8b605
SSDEEP

98304:UI599fQN8A99c/hEmzGm5eZMVFfdjtogZqkl9M9RqTZmAP2fwz+Jmo0:Uw99fQNI9HK6RtogZqWUqTZmQzJo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RH-Anticheat.exe

Files

RH-Anticheat.exe
.exe windows:6 windows x64 arch:x64

7b0344fa5a04f98a7c464a5e2a342488

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadImageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

GetTokenInformation

shell32

ShellExecuteExW

msvcp140d

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z

shlwapi

PathRemoveFileSpecA

vcruntime140d

__std_type_info_destroy_list

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

__p___argc

wtsapi32

WTSSendMessageW

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: - Virtual size: 587B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bitdanc
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bitdanc
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b0344fa5a04f98a7c464a5e2a342488

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140d

shlwapi

vcruntime140d

vcruntime140_1d

ucrtbased

wtsapi32

Sections

.textbss Size: - Virtual size: 64KB

.text Size: - Virtual size: 96KB

.rdata Size: - Virtual size: 31KB

.data Size: - Virtual size: 3KB

.pdata Size: - Virtual size: 12KB

.idata Size: - Virtual size: 9KB

.msvcjmc Size: - Virtual size: 587B

.00cfg Size: - Virtual size: 373B

.bitdanc Size: - Virtual size: 3.3MB

.bitdanc Size: 5.2MB - Virtual size: 5.2MB

.reloc Size: 512B - Virtual size: 168B

.rsrc Size: 512B - Virtual size: 469B

.textbss
Size: - Virtual size: 64KB

.text
Size: - Virtual size: 96KB

.rdata
Size: - Virtual size: 31KB

.data
Size: - Virtual size: 3KB

.pdata
Size: - Virtual size: 12KB

.idata
Size: - Virtual size: 9KB

.msvcjmc
Size: - Virtual size: 587B

.00cfg
Size: - Virtual size: 373B

.bitdanc
Size: - Virtual size: 3.3MB

.bitdanc
Size: 5.2MB - Virtual size: 5.2MB

.reloc
Size: 512B - Virtual size: 168B

.rsrc
Size: 512B - Virtual size: 469B