RCTClassic[.]exe

Resubmissions

28/09/2024, 15:22

240928-sr5rmavfpe 3

28/09/2024, 15:20

240928-sqy8fssdrp 3

Sharing

Copy URL Twitter E-mail

General

Target

RCTClassic.exe
Size

10.3MB
MD5

e6c82e82bab12c0a6010a09896670297
SHA1

a365eb5a35f4e22a9e47ad029236181b28ce6500
SHA256

8d2a1424b0a3a6b2c0b22b271cf8a5c768f8b763caca8d23dea802878f911af6
SHA512

826dcc969656667f483094d9a9fb5ef0ff8384a8bff7812ec67e8b9783690fc8bd8369473d858b2779d54d501e02eb539c684051790b901396d524a05502234d
SSDEEP

98304:ZpFkWT/N2THcmgfwg7w+3QgzOx4NBEWSodN3TxgxCCPgtu2DeG/5EWZ:C3T+3QgNYWSodJT3CZT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RCTClassic.exe

Files

RCTClassic.exe
.exe windows:6 windows x86 arch:x86

44cc163be755b17bc1842acb8d3532c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Work\Carbon\CarbonWindows\Steam Distribution\RCTClassic.pdb

Imports

opengl32

glGetIntegerv
glBlendFunc
glReadPixels
glBindTexture
glTexSubImage2D
wglDeleteContext
glEnableClientState
glDisable
glColorPointer
glDrawArrays
glColor4f
glDisableClientState
glVertexPointer
glEnable
glGetString
wglGetCurrentDC
wglGetProcAddress
glDeleteTextures
glTexImage2D
glGetError
glTexParameteri
glGenTextures
wglCreateContext
glClear
glClearColor
glDrawElements
glScissor
wglMakeCurrent
glViewport

fmod

?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
FMOD_System_Create
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?mixerSuspend@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?mixerResume@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVSound@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?getMasterChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z
?stop@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?setPan@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?isPlaying@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z

kernel32

WideCharToMultiByte
GetSystemDirectoryW
GetProcessHeap
GetModuleHandleW
GetSystemDefaultLCID
GetUserDefaultLCID
HeapFree
VerSetConditionMask
HeapAlloc
FreeLibrary
OpenFile
GetFullPathNameA
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
FindFirstFileA
FindClose
FindNextFileA
GetLastError
CreateMutexA
IsDebuggerPresent
IsProcessorFeaturePresent
DecodePointer
EncodePointer
ExpandEnvironmentStringsA
CloseHandle
WaitForSingleObject
FormatMessageA
VerifyVersionInfoA
SleepEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetLastError
CreateThread
ExpandEnvironmentStringsW
GetShortPathNameW
GetUserDefaultUILanguage
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
LoadLibraryW
Sleep
VerifyVersionInfoW
CreateDirectoryA
SetCurrentDirectoryA
GetTickCount

user32

PostQuitMessage
SetCapture
TranslateMessage
ShowCursor
GetTouchInputInfo
SetCursorPos
PeekMessageA
DefWindowProcA
CloseTouchInputHandle
ShowWindow
DispatchMessageA
RegisterClassExA
GetSystemMetrics
InvalidateRect
SetWindowLongA
CreateWindowExA
LoadCursorA
MessageBoxA
ClientToScreen
AdjustWindowRectEx
SetWindowPos
ReleaseDC
ScreenToClient
GetMessageA
ReleaseCapture
SetCursor
DestroyWindow
EnumDisplaySettingsExA
GetWindowRect
SetForegroundWindow
GetClientRect
SetFocus
GetDC
LoadStringA
LoadIconA

steam_api

SteamAPI_RegisterCallback
SteamUtils
SteamAPI_UnregisterCallResult
SteamClient
SteamFriends
SteamAPI_RegisterCallResult
SteamApps
SteamAPI_WriteMiniDump
SteamAPI_SetMiniDumpComment
SteamUser
SteamAPI_Shutdown
SteamAPI_RunCallbacks
SteamAPI_UnregisterCallback
SteamAPI_Init
SteamUserStats

msvcp110

?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z

msvcr110

malloc
sprintf
strncpy
strrchr
_stricmp
rename
remove
fopen
fread
ftell
_localtime64
fseek
fclose
_stat64i32
longjmp
_time64
sscanf
atoi
atof
??_V@YAXPAX@Z
feof
strstr
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strncmp
free
fputs
_wassert
printf
_gmtime64
strerror
fflush
_errno
__iob_func
fprintf
fputc
sscanf_s
_vsnprintf_s
fopen_s
swprintf_s
_wcsicmp
mbstowcs
wcscat_s
wcstombs
fwrite
isalnum
isspace
strchr
tolower
isalpha
realloc
calloc
memset
memcpy
fgets
qsort
_strtoi64
isxdigit
strpbrk
strtol
strtoul
__sys_nerr
isdigit
_beginthreadex
getenv
_stat64
toupper
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
floor
_vsnprintf
?terminate@@YAXXZ
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
memmove
wcscpy_s
_strdup
_CIatan2
_CIfmod
_CxxThrowException
__CxxFrameHandler3
__CxxLongjmpUnwind
_libm_sse2_cos_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_setjmp3
memchr
_commode

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ws2_32

socket
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
WSAStartup
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
WSAIoctl
connect

gdi32

SetPixelFormat
SwapBuffers
GetStockObject
ChoosePixelFormat

advapi32

CryptImportKey
CryptEncrypt
CryptHashData
CryptDestroyHash
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyKey

shell32

ShellExecuteA
SHGetFolderPathA
SHCreateItemFromParsingName

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 674KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 22.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 921KB - Virtual size: 921KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

44cc163be755b17bc1842acb8d3532c0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

opengl32

fmod

kernel32

user32

steam_api

msvcp110

msvcr110

version

ws2_32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 674KB - Virtual size: 673KB

.data Size: 1.1MB - Virtual size: 22.4MB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 921KB - Virtual size: 921KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 674KB - Virtual size: 673KB

.data
Size: 1.1MB - Virtual size: 22.4MB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 921KB - Virtual size: 921KB