rise_Robusted[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
rise_Robusted.exe
Size 1.8MB
Sample241019-lesszayejg
SHA256 3aeabd53da738eed03110a8c0e117aa00a47ab3295b61b552a109ba64ba35de4
MD5 20739e235c562437740571a2f8764134
SHA1 e46361a7224071ad1cc4dccf18dc3b6fe42a62e6
SHA512 80fd9a5fac081a37d1c880e35b3a23dd4af48b9f3469cbc79e9b8150afe828d6f6dd3f2e31bdf16640a4b8a03d0f690cbba90f5bd2e789d9402d5d4d6d8f18ca
SSDEEP 49152:0jN+ClZkqfSqLMI5iOw0oWjK6Sl80QFYnDLsxR:0x+CrTfSqLMI5i7liFYnD4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rise_Robusted.exe

File Explorer

rise_Robusted.exe

.exe 1.8MB

rise_Robusted.exe

IMPHASH f33c83b617232bfa99f937b5dd271135
SHA256 3aeabd53da738eed03110a8c0e117aa00a47ab3295b61b552a109ba64ba35de4
MD5 20739e235c562437740571a2f8764134
SHA1 e46361a7224071ad1cc4dccf18dc3b6fe42a62e6
SHA512 80fd9a5fac081a37d1c880e35b3a23dd4af48b9f3469cbc79e9b8150afe828d6f6dd3f2e31bdf16640a4b8a03d0f690cbba90f5bd2e789d9402d5d4d6d8f18ca
SSDEEP 49152:0jN+ClZkqfSqLMI5iOw0oWjK6Sl80QFYnDLsxR:0x+CrTfSqLMI5i7liFYnD4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Finn\AppData\Local\Temp\MLEmwfOSkaZ\x64\Release\TemplateRobust.pdb

kernel32

SizeofResource GetCurrentProcess TerminateProcess GetProcessId K32GetProcessImageFileNameA FindResourceA ResumeThread DuplicateHandle OpenProcess GetExitCodeThread Sleep GetTempPathA LoadLibraryA LockResource CloseHandle LoadResource GetProcAddress ExitProcess GetCurrentProcessId GetModuleHandleW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlCaptureContext

ole32

CoInitializeEx

msvcp140

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __C_specific_handler memset __std_exception_copy __std_exception_destroy memchr memcpy __std_terminate __current_exception_context memmove

api-ms-win-crt-stdio-l1-1-0

fread ungetc setvbuf fgetpos fwrite __p__commode _set_fmode fgetc fclose fflush fputc _get_stream_buffer_pointers _fseeki64 fsetpos

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_exit _initialize_narrow_environment __p___argc _configure_narrow_argv _cexit _c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _seh_filter_exe terminate _initterm _invalid_parameter_noinfo_noreturn _get_initial_narrow_environment __p___argv

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale