rhino[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

rhino.exe
Size

142KB
MD5

d62d9989535c4c8db14e50b58c9f25a0
SHA1

91619dffa529908c8c81189a0c5ec95ade6f9992
SHA256

93e70049b60bf5691b43d9e256ca8f459f6bfac832097985bcc6a9040b5ca555
SHA512

80cd8cd74d75b7c9a8e1d09b7941e734109dcdb3615452eb9a50676f28c5f2c84376dcab22da460599b2bbba30741f52979b7770c16badc346ea5432d116b53e
SSDEEP

1536:c9/5kG7HhXq68mm0jm+tSO16LEWhyMN3wqZitMP1mRL4uEVZTZRm3K7hk1AObb0U:WR/kyMNgmqMtG4uKTZRm2z+oKMYcFVU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rhino.exe

Files

rhino.exe
.exe windows:5 windows x86 arch:x86

Password: monkey

5a7976fbce97f619619bc847c7ba9be6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyW
RegCloseKey

kernel32

InterlockedIncrement
InterlockedDecrement
Sleep
GetVersionExW
GetLastError
CreateFileW
DeviceIoControl
CloseHandle
ExitProcess
SetConsoleCtrlHandler
GetComputerNameW
GetProcAddress
GetModuleHandleW
ExpandEnvironmentStringsW
SetFilePointerEx
WriteFile
DefineDosDeviceW
ReleaseMutex
SetEvent
WaitForSingleObject
ResetEvent
CreateMutexW
CreateEventW
TerminateThread
CreateThread
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleW
GetConsoleMode
GetFileType
GetStdHandle
FreeLibrary
LocalFree
LoadLibraryW
FormatMessageW
GetModuleHandleA
GetVersionExA
RtlUnwind
HeapAlloc
HeapFree
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
HeapSize
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
VirtualProtect
GetSystemInfo
VirtualQuery
LoadLibraryA
SetFilePointer
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
FlushFileBuffers
SetStdHandle
ReadFile
SetEndOfFile
GetProcessHeap
GetLocaleInfoW
GetACP
GetOEMCP

ntdll

NtWriteFile
NtReadFile

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrClientCall2
UuidCreate
RpcStringFreeW
UuidToStringW
UuidFromStringW
RpcBindingFree

ole32

CoUninitialize
CoCreateInstanceEx
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces

user32

RegisterClassExW
CreateWindowExW
RegisterDeviceNotificationW
GetMessageW
DestroyWindow
LoadStringW
UnregisterDeviceNotification
DispatchMessageW
wsprintfW
DefWindowProcW
PostThreadMessageW
TranslateMessage

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: monkey

5a7976fbce97f619619bc847c7ba9be6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ntdll

rpcrt4

ole32

setupapi

user32

Sections

.text Size: 109KB - Virtual size: 108KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 28KB - Virtual size: 28KB

.text
Size: 109KB - Virtual size: 108KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 28KB - Virtual size: 28KB