xred | MSRX[.]7z | Triage™

resource
unpack001/MSRX/MSRX.exe
unpack001/MSRX/MagAPI.dll

MSRX.7z

SHA256 447c72c5138078fc11668200f09edaff028ceb40097e409b3ff49125fcc79c9a
MD5 63b8469f969f26dba70a4017c8efa341
SHA1 fb1f0f0bae8f5c2a67ff0d650a192058dd006de0
SHA512 ddff04f1c17e6b3a53b2b1f8b9085cb1e5548f9501017123bfd3bc450789265efa9c43f9d9c4cd825ba80a7e085a2f6ac98009ca8f3ac17b1b066a88d50f2972
SSDEEP 12288:vlWrgFvUlZTm25tRGIxNDZCvcYqAZ+IJuxWKxo9sZBsv0r1/85Q:dWreYTj5tRGIRCvcEZ+s+9Z6cr98q
MD5 SHA1 SHA512 SSDEEP

MSRX/MSRX.exe

SHA256 01eaf6db3eff96a405c630ead532557d77d1f22383cf3521eb61cc041d432b9a
MD5 8eed22631ca6a1573f8bd6443abf9a63
SHA1 1dd9578345f9e5fd9837ffeb5792d64e5b5dc2f3
SHA512 f09acb725d9ae0ea2309e70c04dc626157fb2997ca901ebb0ec9768657fca1b521c1d4481f5873b3077b44580853bf53d5523a43904205f88c4533a134c396a2
SSDEEP 24576:BnsJ39LyjbJkQFMhmC+6GD9UBNMplUHK/AtanJ9jWxAbLH:BnsHyjtk2MYC5GDOMUHgZpWAn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

633728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

MSRX/MagAPI.dll

IMPHASH fed4ccf93c8bceb0c40425d51047de27
SHA256 a4411273bc0c39afdc29b9e1e66f5880f644918a374f4ad079b0fa5eac3493bd
MD5 67f3472d5436422c52a7640f6b1d66cd
SHA1 07a7ae6736a49e9de47b9d3e4538c2fbc5041862
SHA512 4365fcde2c5da35392a8400fc83d5189d573c174c58f26158dc1682f14935716be9c922f7bc4fc08c536610a35d543aa879fa365d1f6d5792d3bd2c785a123da
SSDEEP 1536:UaVrde9a+SQmRdRhT3LILKHYlHGkl5+H5F4GkG9NCDjp:pekddRhOKZk/+H5jNYp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

MSRX/Record1.txt

SHA256 8561e453969eb877541daa38dfbe6a4de1b933f7af8c38119ac5a5ecea176fbe
MD5 cc04918b0afc0320d1b2c114fe043789
SHA1 aa247ec5642978e5f31f12867f6de98c76f690a3
SHA512 fd3686383f85c3b866eb5c55020dfd688f77c29ec9581d9d5fdd54a7b8858070f5785c2f4f1b251f64dece2ac9e873812cbbafae8ebbffb2efd4d320116238c6
MD5 SHA1 SHA512

MSRX/Uninstall/IRIMG1.JPG

SHA256 4abba5414055f45d541f2d4a7d8450091c39ce4990ed0d32fb67a0625102800c
MD5 8e769dbe0e7cf528e30a245abb4defbc
SHA1 3cbd37dedfcce6d116677aa5e270dd0f471e761d
SHA512 63801ecc5f86882cc3a8ddfcbd155d216ca4794818c01f757e263808d4cbf7e1bcc5c3aa779cc39d93a0887995cc1e5c5836827be0ad58823d6edf9ce38f34da
SSDEEP 96:48AQUACU1gPjQGAn8N06KudfBQAipZSZZ8FvQknP0W/NhU/+bqvNdK0z:5AXACU1E01V6KiKAsW8tQa/NhXbizfz
MD5 SHA1 SHA512 SSDEEP

MSRX/Uninstall/IRIMG2.JPG

SHA256 9862fc5877f5c15df854035285df151c66e17c076b04a05d93b00bbf0d247a3c
MD5 6a89adc2be43e619aad8eb7f74b778bd
SHA1 08c785d89457ca66c26e6ca701f5a5326b0d8974
SHA512 710b575b80d8f96b8b0b48e4bd61ee60a6a366fb7261bce3e432bb682360c066d2ddf622c17c1e3ff07d67942daf568db1984853d94df11eb59dfec4d9ada2fd
SSDEEP 384:TTEfwHB0bi/QZkOHVUh3dSNI/7XEUsgZjFgCqKXc1nn+XmoXfsR7L1/:EwHBmi/QZkeVUTSmT0lgZ5gCqASV8fsL
MD5 SHA1 SHA512 SSDEEP

MSRX/Uninstall/uninstall.dat

SHA256 db791fe5ca9e4e9718f5ce1c098c89d556a8bc44837c106e899750e532d9f058
MD5 8f5546ed3abd317c17089e4edc34af45
SHA1 140d363d482a0f59a07954e23eb9f702be4c9f9e
SHA512 274e4d48d1c787ff70805346dc8f08d0a6437200699f48e406aa57bf1d0ec59264f02348fd478ac23bf77f4615fdac03a61957af606093ba56eb6767c3eafa57
SSDEEP 1536:emqVLBYf15yFRTKLF7z3bul+HZIkH5gpNx9FoNUnkKSd4hinTUJ3y:TqQWFRgF7z3bmEgpNx9FoNUnRSdnTUJi
MD5 SHA1 SHA512 SSDEEP

MSRX/Uninstall/uninstall.xml

SHA256 638c3442a5e1f6abe9a32871193ada9e59fd4461fb28dfdae279fe744776c120
MD5 ed976e8661adac5ccc1538c766e213ab
SHA1 87413c46e730bccbd932bce5083bb21cc0bf483b
SHA512 dfaac14298aec298a088529ec10d88304b5543225098564240954dd3eeb0823caff306ac69074fcb54bb41405fe26b17a1b7894a878883be4ed27c3663eff175
SSDEEP 96:p4IpVFH7VFHxVFHIVQdzcHJIW9lS9cj9egw5:p1pVFH7VFHxVFH7WpxY
MD5 SHA1 SHA512 SSDEEP

MSRX.7z

MSRX/MSRX.exe

generic

MSRX/MagAPI.dll

kernel32

user32

generic

MSRX/Record1.txt

MSRX/Uninstall/IRIMG1.JPG

MSRX/Uninstall/IRIMG2.JPG

MSRX/Uninstall/uninstall.dat

MSRX/Uninstall/uninstall.xml

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

MSRX.7z

MSRX/MSRX.exe

generic

MSRX/MagAPI.dll

kernel32

user32

generic

MSRX/Record1.txt

MSRX/Uninstall/IRIMG1.JPG

MSRX/Uninstall/IRIMG2.JPG

MSRX/Uninstall/uninstall.dat

MSRX/Uninstall/uninstall.xml