RFU-x64[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RFU-x64.zip
Size

66KB
MD5

0c4087cbb2f11a2d06124750d5f48e09
SHA1

7e8c77a5216e8a985f10613b11ad752a002ea49a
SHA256

f5e22203369b5ab466eb78c4a303078e4f442029b27a9a23b23398b581199dc6
SHA512

fc4703096e6633eee69f8e29ee6ecd90b4f88bb192b84ecc4410ee2619307d73fe5f481a16d00fd041ae22004a1133fea306404807c25524bc20bf283499bfc7
SSDEEP

1536:wt4s1LjdevIdH6BRGT7C7x/TgU8QtHn4vW6oeSz+t:wt4shovawa7C7x/UgtuSyt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RFU.exe

Files

RFU-x64.zip
.zip

Password: As040414
RFU.exe
.exe windows:6 windows x64 arch:x64

Password: As040414

f68e1d9a0ade1acc33aa63b52aa93443

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\User Documents\Lewis\Documents\Visual Studio 2019\Projects\RFU\x64\Release\RFU.pdb

Imports

kernel32

CreateMutexA
Sleep
GetLastError
CloseHandle
ReadProcessMemory
GetExitCodeProcess
K32EnumProcessModulesEx
OpenProcess
CreateToolhelp32Snapshot
K32GetModuleFileNameExA
Process32NextW
QueryFullProcessImageNameA
Process32FirstW
IsWow64Process
VirtualQueryEx
UnmapViewOfFile
SetConsoleTitleA
TerminateThread
FreeConsole
CreateThread
GetConsoleWindow
AllocConsole
RtlLookupFunctionEntry
WideCharToMultiByte
GetProcessId
GetFileInformationByHandleEx
AreFileApisANSI
GetFileInformationByHandle
CreateFileW
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
WriteProcessMemory
GetModuleFileNameA
GetModuleHandleW
K32GetModuleInformation
MultiByteToWideChar
GetCurrentProcess
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
FormatMessageA
RtlCaptureContext

user32

CreateWindowExW
DefWindowProcW
GetMessageW
CheckMenuRadioItem
GetSystemMenu
EnumWindows
MessageBoxA
GetWindowTextA
SendMessageW
IsWindowVisible
CreatePopupMenu
RegisterClassExW
GetWindowThreadProcessId
TrackPopupMenu
ShowWindow
GetCursorPos
SetForegroundWindow
DispatchMessageW
EnableMenuItem
LoadIconW
PostQuitMessage
AppendMenuW
CheckMenuItem
LoadCursorW
TranslateMessage

gdi32

GetStockObject

advapi32

RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegGetValueA

shell32

Shell_NotifyIconW
ShellExecuteA

msvcp140

??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_alloc@std@@YAXXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

wininet

InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile

vcruntime140

__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strchr
memchr
__current_exception_context
memcmp
memcpy
__C_specific_handler
memmove
_CxxThrowException
__current_exception
memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
freopen_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
getchar
ungetc
__acrt_iob_func
setvbuf
fgetpos
__stdio_common_vsprintf
_set_fmode
fwrite
fgetc
fclose
fflush
fputc
__p__commode

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
_callnewh
realloc
malloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_narrow_environment
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno

api-ms-win-crt-string-l1-1-0

wcscpy_s
isspace
_stricmp
_wcsicmp

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
strtod

api-ms-win-crt-math-l1-1-0

fmin
__setusermatherr
fmax
ceilf
_dclass

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: As040414

Password: As040414

f68e1d9a0ade1acc33aa63b52aa93443

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcp140

wininet

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 78KB - Virtual size: 78KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 214KB - Virtual size: 213KB

.reloc Size: 512B - Virtual size: 424B

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 214KB - Virtual size: 213KB

.reloc
Size: 512B - Virtual size: 424B