RcjaLSVp (2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RcjaLSVp (2).exe
Size

416KB
MD5

59312e2b7b010c611a328c38b115a8cd
SHA1

18bd74d0c84f949ba72e92033373f4af8f947359
SHA256

52cb649eb67af7ce9b25abb29d6c13e9466450e6c66ddf670215d7a76def1351
SHA512

ace3c6dc97d4a41320d6a57e126f253e046e84be4a1e286df8d4d35173ef916b613d289bf5c50bcb1637caaba95601050ee660772612acfa3619767f6eccde86
SSDEEP

6144:sa7PVAslzqSVWLh3ry21Q4K2Mg5Hc/n8XgkzczcNTofXtx9kS+lPXMUk:pTVKSVsVry21QuM6c/8bcgqdP3V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RcjaLSVp (2).exe

Files

RcjaLSVp (2).exe
.exe windows:6 windows x64 arch:x64

e588dde1b0cde68fb014ea10a2bd5aa2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\hatred\Documents\projects\WexizeDllExternal\x64\Release\WexizeDllExternal.pdb

Imports

kernel32

GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
GetFileSizeEx
CreateFileA
FormatMessageA
SetLastError
WaitForMultipleObjects
IsProcessorFeaturePresent
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
MultiByteToWideChar
WaitForSingleObjectEx
MoveFileExA
Sleep
GetTickCount
QueryPerformanceCounter
VerifyVersionInfoA
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
GetLastError
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
WriteProcessMemory
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
SetThreadContext
CreateProcessA
VirtualAllocEx
GetProcAddress
GetThreadContext
CloseHandle
GetModuleHandleA
ResumeThread
PeekNamedPipe

msvcp140

?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

ntdll

VerSetConditionMask

ws2_32

listen
ioctlsocket
__WSAFDIsSet
htonl
WSACleanup
freeaddrinfo
WSAStartup
WSAIoctl
select
WSASetLastError
socket
getaddrinfo
setsockopt
accept
htons
getsockopt
recvfrom
sendto
getsockname
gethostname
ntohs
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
ntohl

normaliz

IdnToAscii

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertOpenStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore

wldap32

ord45
ord60
ord211
ord46
ord50
ord217
ord41
ord301
ord200
ord30
ord79
ord35
ord22
ord33
ord32
ord26
ord27
ord143

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
memcpy
memset
strchr
strrchr
memmove
strstr
memcmp
memchr
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
__std_exception_destroy
__std_exception_copy

api-ms-win-crt-heap-l1-1-0

calloc
malloc
realloc
free
_set_new_mode
_callnewh

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_configure_narrow_argv
_initterm
terminate
_set_app_type
_seh_filter_exe
__sys_nerr
_getpid
_crt_atexit
_get_initial_narrow_environment
_register_onexit_function
_beginthreadex
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
strerror
_cexit
_errno
__p___argv
_invalid_parameter_noinfo_noreturn
__p___argc
_initterm_e
_exit
exit

api-ms-win-crt-stdio-l1-1-0

fread
fclose
__acrt_iob_func
fgets
_open
_close
_write
_read
fopen
fputs
__stdio_common_vsscanf
__p__commode
_set_fmode
feof
fseek
ftell
_lseeki64
fflush
fputc
fwrite
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strcmp
strpbrk
tolower
strcspn
strncpy
_strdup
isupper
strspn
strncmp

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_unlink
_fstat64
_stat64
_access

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
strtoll
atoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

advapi32

CryptEncrypt
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptAcquireContextA

Sections

.text
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e588dde1b0cde68fb014ea10a2bd5aa2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

ntdll

ws2_32

normaliz

crypt32

wldap32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

Sections

.text Size: 319KB - Virtual size: 318KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 14KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 319KB - Virtual size: 318KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB