rustup-init[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rustup-init.exe
Size

6.7MB
MD5

183220985f842b5a3c27b27242e9f244
SHA1

8f4b35e801af3b01eca0aecc9681bbe118996858
SHA256

011185bd2bfce79f5389c19247b6e45242d17c697fe135ec6cdd23948445803a
SHA512

2e834b72139fb4ab3bc1eac26b8422d19e2120196ffe2cc5058fd6074082ebdcdd3ef7dfeda277a0a0449e18bbe3009cbb7abaec2c7c2866c9d64ba3461aa16e
SSDEEP

98304:5udFF04SjU3zar/pcNmJbhnwiCbwSkSeIiUHb0Z+6m1ImHniXxUMKs/f:5udFF8U4xsmJbhnwiCbwSGZ+PiX7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rustup-init.exe

Files

rustup-init.exe
.exe windows:6 windows x86 arch:x86

3036e24ead16bfe6e1e9b7e14b6938c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\rustup\rustup\target\i686-pc-windows-msvc\release\deps\rustup_init.pdb

Imports

kernel32

GetFileInformationByHandleEx
GetACP
IsValidCodePage
FindFirstFileExW
SetFileInformationByHandle
SetEndOfFile
SwitchToThread
SetStdHandle
GetFileAttributesExW
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
TryAcquireSRWLockExclusive
GetFullPathNameW
QueryInformationJobObject
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
GetSystemInfo
DuplicateHandle
IsProcessInJob
GetCurrentProcess
FlushFileBuffers
SetFilePointerEx
LCMapStringW
CompareStringW
GetModuleHandleW
GetOEMCP
GetConsoleScreenBufferInfo
GetTimeFormatW
GetDateFormatW
OutputDebugStringW
DecodePointer
GetConsoleOutputCP
GetCommandLineA
SetInformationJobObject
CreateJobObjectW
AssignProcessToJobObject
SetConsoleCtrlHandler
DeviceIoControl
CreateSymbolicLinkW
CreateFileW
Sleep
MoveFileExW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
SleepEx
ReadFileEx
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
WriteFile
GetCPInfo
GetFileInformationByHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
SetEnvironmentVariableW
GetStringTypeW
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetTimeZoneInformation
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
ReleaseMutex
WaitForSingleObjectEx
CreateMutexA
RtlCaptureContext
GetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
WideCharToMultiByte
ReadConsoleW
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
CreateEventW
CancelIo
ReadFile
ExitProcess
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
RemoveDirectoryW
CreateHardLinkW
CopyFileExW
GetFileType
SetHandleInformation
SetConsoleMode
PostQueuedCompletionStatus
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
SetConsoleTextAttribute
GlobalMemoryStatusEx
GetModuleHandleExW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlUnwind
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
CreateEventA
LoadLibraryExA
VirtualQuery
GetSystemDirectoryA
VirtualProtect
RaiseException
GetStartupInfoW
MoveFileExA
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
FindClose
GetNativeSystemInfo
GetCurrentThread
GetLastError
SetThreadStackGuarantee
AddVectoredExceptionHandler
ReleaseSRWLockExclusive
CloseHandle
GetCurrentProcessId
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
AcquireSRWLockExclusive
TlsSetValue
TlsGetValue
GetStdHandle
SetDefaultDllDirectories
HeapReAlloc
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
IsProcessorFeaturePresent
HeapFree
HeapSize

advapi32

SystemFunction036
RegDeleteTreeW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
RegQueryValueExW
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
RegOpenKeyExW

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
SysStringLen

crypt32

CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertFindExtension
CertGetEnhancedKeyUsage
CertDuplicateCertificateChain
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateStore
CertVerifyTimeValidity
CertAddCertificateContextToStore
CertOpenStore

ws2_32

WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSASend
WSAEventSelect
recv
accept
WSAStartup
freeaddrinfo
getaddrinfo
send
bind
WSAIoctl
connect
ioctlsocket
socket
shutdown
setsockopt
WSAWaitForMultipleEvents
closesocket
htonl
getsockname
WSAGetLastError
getpeername
listen
WSASetLastError
ntohs
htons
WSAResetEvent
WSASocketW
__WSAFDIsSet
getsockopt
select
WSACleanup

ntdll

NtCreateFile
RtlInitUnicodeString
NtCancelIoFileEx
NtWriteFile
NtReadFile
RtlNtStatusToDosError
NtDeviceIoControlFile

shell32

ShellExecuteW
SHGetKnownFolderPath

user32

SendMessageTimeoutA

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3036e24ead16bfe6e1e9b7e14b6938c3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

oleaut32

crypt32

ws2_32

ntdll

shell32

user32

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 5KB - Virtual size: 8KB

.reloc Size: 241KB - Virtual size: 241KB

.text
Size: 5.3MB - Virtual size: 5.3MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 5KB - Virtual size: 8KB

.reloc
Size: 241KB - Virtual size: 241KB