ROKBot[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ROKBot.exe
Size

9.1MB
MD5

f8d136a09c00edc674c1d4225462f598
SHA1

87d5c52a262d074cbdc9e8c29a4b10bbc4e15a9b
SHA256

66e43f6ebbff5895aae982d36cb7b5a695299c391b2ad4f182be52e90228ca09
SHA512

c012871f0bb630cedc0e949be7d982e1949fe9e7381bedcc1246c0d485d631be0a7721b821ad4eb6e690851da2ca1d53038ce424a1050396fdecfcda8236bd6a
SSDEEP

196608:vbA3Oxuwb493rUisbBdIZdIwu2vhw5/Cl/fm2DHC9:jA3Oxuwb493rUisbBdIZdIwf+/j9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ROKBot.exe

Files

ROKBot.exe
.exe windows:6 windows x86 arch:x86

b9e1da107a8b48210ce0b8f187f51453

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseSRWLockShared
AcquireSRWLockShared
SetConsoleMode
ReadConsoleA
GetEnvironmentVariableW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetConsoleCtrlHandler
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetDateFormatW
VirtualAlloc
GetSystemInfo
SetStdHandle
HeapQueryInformation
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetCommandLineA
WriteConsoleW
GetStdHandle
GetModuleHandleExW
GetStartupInfoW
ExitThread
GetFileType
GetFileInformationByHandle
GetDriveTypeW
RtlUnwind
GetCPInfo
VirtualFree
LCMapStringEx
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetStringTypeW
FormatMessageA
OutputDebugStringW
SwitchToFiber
CreateFiberEx
DeleteFiber
GetSystemDirectoryA
IsDebuggerPresent
InitializeSListHead
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ConvertFiberToThread
CompareStringEx
GetUserDefaultLCID
GetTempFileNameW
SearchPathW
GetProfileIntW
GetTempPathW
GetWindowsDirectoryW
FindResourceExW
SetErrorMode
GetCurrentDirectoryW
lstrcpyW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
DeleteFileW
ConvertThreadToFiberEx
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalFlags
GetThreadLocale
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
WritePrivateProfileStringW
lstrcmpA
GetCurrentThread
GetVersionExW
GlobalGetAtomNameW
SetThreadPriority
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LocalAlloc
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryA
LoadLibraryExW
EncodePointer
ReleaseMutex
GlobalSize
OutputDebugStringA
SystemTimeToFileTime
CreateEventW
GetSystemTime
QueryPerformanceCounter
WaitForSingleObjectEx
VerifyVersionInfoW
VerSetConditionMask
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
FreeLibrary
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleW
QueryPerformanceFrequency
FormatMessageW
VirtualQuery
VirtualProtect
ResumeThread
GetExitCodeThread
OpenThread
GetCurrentThreadId
ExitProcess
DeviceIoControl
SetLastError
GetProcessHeap
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
HeapFree
GetCommandLineW
GetModuleFileNameW
CreateMutexW
CopyFileW
GetTickCount64
CreateDirectoryW
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetNativeSystemInfo
GetProcessTimes
ReadProcessMemory
GetCurrentProcessId
WriteFile
SetNamedPipeHandleState
PeekNamedPipe
WaitNamedPipeW
Sleep
SuspendThread
FindClose
FindNextFileW
FindFirstFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
MoveFileExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LocalFree
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
TerminateThread
GetModuleHandleA
GetProcAddress
TerminateProcess
OpenProcess
CreateProcessW
MultiByteToWideChar
ReadFile
GetFileSize
CreateFileW
lstrlenW
WideCharToMultiByte
lstrlenA
FindResourceW
LoadResource
LockResource
SizeofResource
GetTickCount
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
FreeLibraryAndExitThread

user32

InflateRect
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
IsWindowEnabled
CheckDlgButton
MoveWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
ClientToScreen
WindowFromPoint
GetSystemMetrics
DestroyMenu
GetMessageW
EnableWindow
GetSysColor
GetClientRect
GetWindowRect
SetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassLongW
EqualRect
MapWindowPoints
ScreenToClient
MessageBoxW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
EndPaint
BeginPaint
TranslateMessage
GetKeyNameTextW
MapVirtualKeyW
LoadAcceleratorsW
TranslateAcceleratorW
CreatePopupMenu
DestroyIcon
LoadImageW
UnpackDDElParam
ReuseDDElParam
SendDlgItemMessageA
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
GetSysColorBrush
RealChildWindowFromPoint
SetActiveWindow
TrackPopupMenu
CopyImage
GetAsyncKeyState
CharUpperW
UnionRect
GetSystemMenu
TrackMouseEvent
CharNextW
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
IntersectRect
OffsetRect
SendMessageW
DrawIconEx
FrameRect
PtInRect
RedrawWindow
DefWindowProcW
GetFocus
IsWindow
InvalidateRect
GetUserObjectInformationW
GetProcessWindowStation
LoadCursorW
CopyRect
IsWindowVisible
GetParent
PostMessageW
SetCursor
LoadIconW
CreateWindowExW
SetParent
SetWindowLongW
GetComboBoxInfo
ValidateRect
SetWindowTextW
SetWindowPos
SetFocus
UpdateWindow
GetWindowTextW
ShowWindow
GetDC
ReleaseDC
CallWindowProcW
GetKeyState
GetSubMenu
MessageBeep
GetWindowDC
FindWindowW
GetClassNameW
GetWindowThreadProcessId
GetWindow
FindWindowExW
IsHungAppWindow
GetClassNameA
GetWindowLongW
FindWindowA
GetCursorPos
LoadBitmapW
GetIconInfo
CreateIconIndirect
DrawTextW
IsZoomed
SystemParametersInfoW
TabbedTextOutW
DrawTextExW
GrayStringW
DestroyWindow
IsMenu
GetMenuItemInfoW
SetMenuItemInfoW
GetMenuItemCount
LoadMenuW
AppendMenuW
InsertMenuW
InsertMenuItemW
DeleteMenu
GetMenuItemID
CheckMenuItem
GetMenuState
EnableMenuItem
FillRect
SetRectEmpty
SetCapture
ReleaseCapture
IsRectEmpty
SetTimer
KillTimer
SetRect
SetLayeredWindowAttributes
SetWindowRgn
RemoveMenu
LockWindowUpdate
GetForegroundWindow
SendMessageTimeoutW
IsIconic
SetForegroundWindow
BringWindowToTop
UnregisterClassW
GetWindowTextA
GetMenuStringW
GetMenuDefaultItem
DrawFocusRect
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
SetClassLongW
DrawEdge
DrawFrameControl
SetCursorPos
CopyIcon
DrawIcon
RegisterClipboardFormatW
UpdateLayeredWindow
MonitorFromPoint
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
GetMenu
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
RegisterClassW
GetClassInfoW
GetClassInfoExW
IsChild
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetDlgCtrlID
GetCapture
SetMenu

gdi32

GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextColor
GetRgnBox
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
OffsetRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
CreateFontW
AddFontMemResourceEx
GetBkColor
GetDeviceCaps
RoundRect
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetBitmapBits
SetBitmapBits
CreateBitmap
TextOutW
CreateCompatibleBitmap
PtVisible
RectVisible
ExtTextOutW
Escape
Rectangle
GetBkMode
CreatePolygonRgn
GetClipBox
ExcludeClipRect
CreatePen
CreateHatchBrush
DPtoLP
SetRectRgn
PatBlt
GetMapMode
GetObjectType
CreatePatternBrush
CreateRectRgnIndirect
CreateSolidBrush
EnumFontFamiliesW
GetObjectW
CreateRectRgn
CombineRgn
FillRgn
FrameRgn
GetTextMetricsW
CopyMetaFileW
CreateDCW
SetBkColor
SetTextColor
GetTextExtentPoint32W

msimg32

AlphaBlend
TransparentBlt
GradientFill

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegisterEventSourceW
DeregisterEventSource
CryptGetUserKey
CryptDestroyKey
CryptDecrypt
CryptSetHashParam
CryptSignHashW
CryptExportKey
CryptGetProvParam
CryptEnumProvidersW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegDeleteTreeW
RegEnumKeyExW
RegSetKeyValueW
RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
ReportEventW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
Shell_NotifyIconW
DragQueryFileW
DragFinish
SHAppBarMessage
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetPathFromIDListW
SHGetFileInfoW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

StrStrIW
PathFileExistsW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFindFileNameW
PathFileExistsA
PathFindExtensionW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW

uxtheme

IsAppThemed
IsThemeBackgroundPartiallyTransparent
DrawThemeBackground
CloseThemeData
GetThemePartSize
GetThemeColor
GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
DrawThemeText
OpenThemeData
DrawThemeParentBackground

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitialize
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
RegisterDragDrop

oleaut32

SysFreeString
OleCreateFontIndirect
LoadTypeLi
VarBstrFromDate
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen

oledlg

OleUIBusyW

gdiplus

GdipFillPolygonI
GdipCloneImage
GdipDisposeImage
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipLoadImageFromStream
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRectI
GdipGetImageWidth
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDrawImageRectI

ws2_32

__WSAFDIsSet
getsockopt
WSASetLastError
select
ioctlsocket
WSAGetLastError
WSACleanup
ntohs
setsockopt
recv
send
connect
socket
WSAStartup
inet_addr
htons
closesocket
shutdown
htonl
gethostbyname
getservbyname
inet_ntoa
getservbyport
gethostbyaddr
gethostname
ntohl

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

iphlpapi

SetTcpEntry
GetExtendedTcpTable

crypt32

CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertGetIntendedKeyUsage
CertOpenStore
CertFindCertificateInStore

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

wininet

InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetQueryDataAvailable
InternetSetFilePointer
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetOpenW
HttpAddRequestHeadersW
HttpSendRequestW
HttpEndRequestW
HttpSendRequestExW
InternetWriteFile
HttpOpenRequestW

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

winmm

PlaySoundW

bcrypt

BCryptGenRandom

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1015KB - Virtual size: 1014KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 528KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9e1da107a8b48210ce0b8f187f51453

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

version

iphlpapi

crypt32

oleacc

wininet

imm32

winmm

bcrypt

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 1015KB - Virtual size: 1014KB

.data Size: 74KB - Virtual size: 130KB

.rsrc Size: 528KB - Virtual size: 528KB

.reloc Size: 295KB - Virtual size: 295KB

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 1015KB - Virtual size: 1014KB

.data
Size: 74KB - Virtual size: 130KB

.rsrc
Size: 528KB - Virtual size: 528KB

.reloc
Size: 295KB - Virtual size: 295KB