Behavioral task
behavioral1
Sample
rizzing.exe
Resource
win10v2004-20240802-en
General
-
Target
rizzing.exe
-
Size
23.3MB
-
MD5
0ed897cda8574680b0db7749d9927869
-
SHA1
2bf486edc0f49d7397d81071b08f3d07db72d319
-
SHA256
540abf386f1bd706e442b7cd602c00621615c43650fdc3688c087d246e6f91ad
-
SHA512
e073531b640586d70a3432011784cd497ff39d46b00450b1d94d747120dae9add4c90f973ccbaff89c9312d827d31ae4214895470aff6dd71eb671063dc1e83c
-
SSDEEP
393216:C82LCOkVzSFurEUWj3EXpJbTic75cfSybp4UggpcG3Z4dDZeQyOpXmXXHN+s1+kk:hOkgFdbIJbTiumfSybpuG3Z6teQyO6Hp
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rizzing.exe
Files
-
rizzing.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 208KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 126KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
RisingInstaller.pyc