RuntimeBrokerVers[.]exe

General

Target
RuntimeBrokerVers.exe
Size 13.1MB
Sample241113-hb7aeaxbpg
SHA256 7ba7384b9e549f4acd31b23cf4cd91db380899f8a517477e50d3087139322340
MD5 ae312065fea9d2bb96daf340a2684e80
SHA1 2a4db6fca345b56225ca3be9e95c33b97cabc212
SHA512 b0bc9fab62e36fcfa78148ddeb39762e5097cb5a922f1c07f45bcd523346be4c5646653d4ea3eaee9fabda104ebe17f4066cdf0f29fc72c1ce6cc23302d019c3
SSDEEP 196608:s//oYEafIlN5XRmU8bKQqrB9fuFGb0nmxS/qbmI0B8w0nwBUHVLe3Sfxbwk3VKMh:YAF+OIU8bYfvS/NBp5+xbB3VKM4r2MZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RuntimeBrokerVers.exe

File Explorer

RuntimeBrokerVers.exe

.exe 13.1MB

RuntimeBrokerVers.exe

IMPHASH 737496d2b1acecfc9a74fba8047d8fe9
SHA256 7ba7384b9e549f4acd31b23cf4cd91db380899f8a517477e50d3087139322340
MD5 ae312065fea9d2bb96daf340a2684e80
SHA1 2a4db6fca345b56225ca3be9e95c33b97cabc212
SHA512 b0bc9fab62e36fcfa78148ddeb39762e5097cb5a922f1c07f45bcd523346be4c5646653d4ea3eaee9fabda104ebe17f4066cdf0f29fc72c1ce6cc23302d019c3
SSDEEP 196608:s//oYEafIlN5XRmU8bKQqrB9fuFGb0nmxS/qbmI0B8w0nwBUHVLe3Sfxbwk3VKMh:YAF+OIU8bYfvS/NBp5+xbB3VKM4r2MZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

50596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW

kernel32

SetLastError WriteConsoleW CreateDirectoryW SizeofResource SetConsoleCtrlHandler GetCommandLineW GetStdHandle WriteFile TerminateProcess GetModuleFileNameW SetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW Sleep GetLastError LockResource CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapReAlloc RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc MultiByteToWideChar HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize

Sharing