R2R[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

R2R.zip
Size

71.5MB
MD5

966d250b32e0b75d63fc858045798cb9
SHA1

76d0b1b2870aa766a95a57d9bae4a9005d1814c5
SHA256

83820b990f7c65e454759feb3c6e142d801d0f64946f77ad566d7bbd846b43fb
SHA512

d1329027889a92a8cde01bd7aac99722472c2970d46f8d0065289f232a82a0b9e02416207ffd27cbeef105066e1e7aaf364d21d0bba072c6b6ae5ee1a438956c
SSDEEP

1572864:/3JGusA9ifbi//E2OMdnibtb1vKtbzfzRwaflTph5GwOt3sg+f:xGuHwbiE2O2ibtb1vmfzRwazh4t3i

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/R2R/FL_Studio_20_0_3_532_Patched.7z.exe
unpack001/R2R/ImageLine_RSA2048_Keygen.exe
unpack002/$TEMP/BASSMOD.dll
unpack002/$TEMP/R2RILKG2.dll
unpack002/$TEMP/keygen.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/R2R/ImageLine_RSA2048_Keygen.exe	nsis_installer_1
static1/unpack001/R2R/ImageLine_RSA2048_Keygen.exe	nsis_installer_2

Files

R2R.zip
.zip
R2R/FL_Studio_20_0_3_532_Patched.7z.exe
.exe windows:4 windows x86 arch:x86

da401ef5e9d5c4599673c26d95fa6029

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
SysStringLen

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleInitialize

user32

CheckDlgButton
IsDlgButtonChecked
EndDialog
SetDlgItemTextW
GetFocus
SetFocus
GetKeyState
InvalidateRect
SetWindowTextW
EnableWindow
PostMessageW
MessageBoxW
SetTimer
DialogBoxParamW
SetWindowLongW
GetWindowLongW
ShowWindow
MoveWindow
ScreenToClient
GetDlgItem
GetWindowRect
MapDialogRect
SystemParametersInfoW
GetWindowTextLengthW
GetWindowTextW
SendMessageW
LoadStringW
CharUpperW
LoadIconW
GetParent
SetCursor
LoadCursorW
KillTimer

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHGetMalloc

msvcrt

wcsstr
wcscmp
_beginthreadex
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_CxxThrowException
malloc
memcpy
memmove
memset
_purecall
memcmp
__CxxFrameHandler
free

kernel32

GetStartupInfoA
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
lstrlenW
lstrcatW
VirtualFree
VirtualAlloc
SetPriorityClass
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetFileInformationByHandle
GetStdHandle
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetFileAttributesW
GetModuleHandleA
FindNextFileW
FindFirstFileW
FindClose
GetTickCount
GetCurrentDirectoryW
SetLastError
DeleteFileW
CreateDirectoryW
GetModuleHandleW
MoveFileW
RemoveDirectoryW
SetFileAttributesW
CreateFileW
SetFileTime
CloseHandle
GetSystemDirectoryW
FormatMessageW
LocalFree
GetModuleFileNameW
MultiByteToWideChar
GetLastError
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCommandLineW
LoadLibraryExW

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R2R/ImageLine_RSA2048_Keygen.exe
.exe windows:4 windows x86 arch:x86

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetCurrentDirectoryA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA

advapi32

AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/BASSMOD.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASSMOD_ErrorGetCode
BASSMOD_Free
BASSMOD_GetCPU
BASSMOD_GetDeviceDescription
BASSMOD_GetVersion
BASSMOD_GetVolume
BASSMOD_Init
BASSMOD_MusicDecode
BASSMOD_MusicFree
BASSMOD_MusicGetLength
BASSMOD_MusicGetName
BASSMOD_MusicGetPosition
BASSMOD_MusicGetVolume
BASSMOD_MusicIsActive
BASSMOD_MusicLoad
BASSMOD_MusicPause
BASSMOD_MusicPlay
BASSMOD_MusicPlayEx
BASSMOD_MusicRemoveSync
BASSMOD_MusicSetAmplify
BASSMOD_MusicSetPanSep
BASSMOD_MusicSetPosition
BASSMOD_MusicSetPositionScaler
BASSMOD_MusicSetSync
BASSMOD_MusicSetVolume
BASSMOD_MusicStop
BASSMOD_SetVolume

Sections

Size: 31KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$TEMP/R2RILKG2.dll
.dll windows:6 windows x86 arch:x86

72ec1c6c7501ee534e1452afe83a6db6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReadFile
WriteFile
IsDebuggerPresent
CloseHandle
SetUnhandledExceptionFilter
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
FlushFileBuffers
GetCurrentProcess
ExitProcess
TerminateProcess
GetCurrentThreadId
FreeLibrary
GetProcAddress
GetLocaleInfoW
lstrcatA
lstrlenA
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
CreateFileA
FindClose
CreateFileW
Sleep
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetWindowsDirectoryA
lstrcpyA
lstrcmpA
GetFileSize
LocalFree
LocalAlloc
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetLastError
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetStdHandle
GetACP
GetModuleFileNameA
HeapReAlloc
HeapFree
HeapAlloc
GetModuleHandleExW
InterlockedFlushSList
LoadLibraryExW
RtlUnwind
DecodePointer
EncodePointer
RaiseException
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
UnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetCPInfo
GetStringTypeW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar

user32

MessageBoxA
CharUpperA
wsprintfA

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey

winmm

timeBeginPeriod

Exports

Exports

R2RScan
RegisterLicense

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/bgm.xm
$TEMP/keygen.exe
.exe windows:4 windows x86 arch:x86

9afd408c16ad749aaf647af5f1acf3a7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

_TrackMouseEvent
ord17

kernel32

MultiByteToWideChar
SetEndOfFile
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
CreateFileA
FlushFileBuffers
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
VirtualQuery
VirtualProtect
GetCPInfo
GetOEMCP
GetACP
HeapSize
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ReadFile
CloseHandle
LCMapStringW
LCMapStringA
SetFilePointer
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersionExA
GetStartupInfoA
GetModuleHandleA
SetCurrentDirectoryA
SetEnvironmentVariableA
CreateDirectoryA
GetLastError
GetFullPathNameA
GetCurrentDirectoryA
GetDriveTypeA
HeapReAlloc
RtlUnwind
RaiseException
HeapFree
GetLocalTime
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
GetShortPathNameA
GlobalLock
GlobalUnlock
MulDiv
GlobalAlloc
GlobalFree
GetCommandLineA
GetSystemInfo
GlobalMemoryStatus
GetVersion
GetComputerNameA
GetWindowsDirectoryA
GetSystemDirectoryA
WinExec
GetProcAddress
LoadLibraryA
FreeLibrary
WideCharToMultiByte
Sleep
HeapAlloc
GetModuleFileNameA
GetTickCount

user32

MessageBoxA
ShowCursor
ChangeDisplaySettingsA
SetClassLongA
EnumDisplaySettingsA
SetCursorPos
GetCursorPos
GetAsyncKeyState
GetSystemMetrics
SetWindowPos
SetActiveWindow
ShowWindow
ReleaseDC
DestroyWindow
SendMessageA
AdjustWindowRectEx
UnregisterClassA
LoadIconA
LoadCursorA
RegisterClassA
PostQuitMessage
InvalidateRect
DefWindowProcA
BeginPaint
EndPaint
FillRect
TabbedTextOutA
GetSysColor
MoveWindow
GetActiveWindow
GetClassLongA
CreateWindowExA
SetWindowLongA
IsWindowEnabled
EnableWindow
SetFocus
GetFocus
GetWindowLongA
GetClientRect
InflateRect
DrawFocusRect
DrawTextA
PostMessageA
SetWindowTextA
GetDlgItemTextA
GetDlgCtrlID
IsDlgButtonChecked
CallWindowProcA
FindWindowA
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
MapVirtualKeyA
GetWindowRect
GetDC

gdi32

CreateDIBSection
CreateCompatibleDC
Rectangle
DeleteDC
SetStretchBltMode
StretchBlt
Ellipse
MoveToEx
LineTo
SetPixel
GetPixel
GetTextExtentPoint32A
SetDIBColorTable
CreatePalette
CreateSolidBrush
CreatePen
GetTextMetricsA
SelectPalette
RealizePalette
BitBlt
SelectObject
SetBkMode
SetTextColor
GetStockObject
CreateFontIndirectA
DeleteObject
GetDeviceCaps

comdlg32

GetOpenFileNameA
ChooseColorA
GetSaveFileNameA

advapi32

GetUserNameA

shell32

ShellExecuteA
ShellExecuteExA
SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

winmm

sndPlaySoundA
mciSendStringA
timeEndPeriod
timeGetDevCaps
timeGetTime
timeBeginPeriod

Sections

.text
Size: 135KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
R2R/R2R.txt

Sharing

General

Malware Config

Signatures

Files

da401ef5e9d5c4599673c26d95fa6029

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

ole32

user32

shell32

msvcrt

kernel32

Sections

.text Size: 165KB - Virtual size: 164KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 512B - Virtual size: 17KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 8KB - Virtual size: 8KB

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 106KB

.ndata Size: - Virtual size: 32KB

.rsrc Size: 138KB - Virtual size: 138KB

Headers

File Characteristics

Exports

Exports

Sections

Size: 31KB - Virtual size: 68KB

Size: 2KB - Virtual size: 1KB

72ec1c6c7501ee534e1452afe83a6db6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

winmm

Exports

Exports

Sections

.text Size: 165KB - Virtual size: 164KB

.rdata Size: 98KB - Virtual size: 98KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 520B

.reloc Size: 10KB - Virtual size: 10KB

9afd408c16ad749aaf647af5f1acf3a7

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

winmm

Sections

.text Size: 135KB - Virtual size: 136KB

.text
Size: 165KB - Virtual size: 164KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 512B - Virtual size: 17KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 8KB - Virtual size: 8KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 106KB

.ndata
Size: - Virtual size: 32KB

.rsrc
Size: 138KB - Virtual size: 138KB

.text
Size: 165KB - Virtual size: 164KB

.rdata
Size: 98KB - Virtual size: 98KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 520B

.reloc
Size: 10KB - Virtual size: 10KB

.text
Size: 135KB - Virtual size: 136KB

.rdata
Size: 26KB - Virtual size: 28KB

.data
Size: 4KB - Virtual size: 16KB