Static task
static1
Behavioral task
behavioral1
Sample
rains hwid (1).exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
rains hwid (1).exe
Resource
win10v2004-20240802-en
General
-
Target
rains hwid (1).exe
-
Size
16.1MB
-
MD5
b70faa6bea34432debd749f3b1b8720e
-
SHA1
3f368053e654892c3f9b3ecdfd6962ce88364e5d
-
SHA256
12eb7fd26d6593a71a30b1b2d16e720788f74a5123b98ad97f9a45cf72ba05ec
-
SHA512
74d3ec1780c6d242957cb1a4874de8a55b01c72cae3eac859171bdae7435ebd2b7015be5030896d490945b6fe8037dc78af287b8de1ded75a7e96023e909e442
-
SSDEEP
393216:pv7QI+Zc7sa/p8fSbvaXjbvv3i/3Ky6wEIR8gUBzgJCjR4P:1ucwa/q6vArS7EIR8Nte
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rains hwid (1).exe
Files
-
rains hwid (1).exe.exe windows:6 windows x64 arch:x64
3d9b4b39c1ad6779748ac2b025705638
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateDirectoryW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CloseServiceHandle
shell32
Shell_NotifyIconA
ole32
CoInitializeEx
imm32
ImmReleaseContext
msvcp140
?_Throw_Cpp_error@std@@YAXH@Z
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord27
crypt32
CertFreeCertificateChainEngine
ws2_32
recv
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: - Virtual size: 852KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.D$R Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.:%* Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.5zD Size: 16.1MB - Virtual size: 16.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ