C:\yureso66\wuja\yuxokulodi-nolibokesoxam-dib se.pdb
Static task
static1
Behavioral task
behavioral1
Sample
rar.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
rar.exe
Resource
win10v2004-20250217-en
General
-
Target
rar.exe
-
Size
392KB
-
MD5
18488edb28f9d6bda06fa6bb7a3529c5
-
SHA1
6e0a4286e24a220701f1d460c3c57b12c446106b
-
SHA256
d6aa06fe25ed9f1b582251e01af0bbcb2d279f7fa57e8265c0823194793df309
-
SHA512
8781b7e204bff1f79378c4bdfd4dba14fd9a3a968d5f858d1f291e5166ebe912d7d7315824a76fba25e6bfba82be6b8d1245dc74909825889c8aea1ef1b16b2c
-
SSDEEP
6144:7DKqGZVEkU/krRcGV4wiiFCGJGh3CxHcTDH/MKItpZF2I:7eqmVXRcGV4wvCGJ+Cx8TDH/yXZF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rar.exe
Files
-
rar.exe.exe windows:5 windows x86 arch:x86
88be4c18f1a5b5e08e67d5348e0895f5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetComputerNameA
CreateMutexW
WriteConsoleInputW
WritePrivateProfileStructA
GetConsoleAliasesLengthW
CopyFileExW
TlsGetValue
CommConfigDialogA
GetDefaultCommConfigW
FindResourceExW
GetProcessIoCounters
FreeLibrary
CallNamedPipeA
SetConsoleTextAttribute
GetCommState
InterlockedDecrement
ZombifyActCtx
ScrollConsoleScreenBufferW
GetNamedPipeHandleStateA
SetComputerNameW
CreateDirectoryExA
GetModuleHandleW
CreateNamedPipeW
WriteFileGather
SetProcessPriorityBoost
GetSystemDirectoryW
LoadLibraryW
GetConsoleMode
SetCommConfig
SizeofResource
GetCalendarInfoA
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryA
GetSystemTimeAdjustment
InterlockedPopEntrySList
GlobalFlags
SetConsoleCursorPosition
GetBinaryTypeA
IsDBCSLeadByte
ReadFile
GetBinaryTypeW
GetOverlappedResult
CompareStringW
ExitThread
lstrlenW
GetStartupInfoW
GlobalUnlock
LCMapStringA
VerifyVersionInfoW
CreateDirectoryA
GetProfileIntA
GetFileSizeEx
SetCurrentDirectoryA
SetThreadLocale
GetCPInfoExW
OpenMutexW
GetCurrentDirectoryW
ReadConsoleOutputCharacterA
GetProcessHeaps
SetVolumeLabelW
WriteProfileSectionA
SetStdHandle
FreeUserPhysicalPages
SearchPathA
GetPrivateProfileStringA
GetLocalTime
GetAtomNameA
LoadLibraryA
LocalAlloc
GetTapeParameters
WTSGetActiveConsoleSessionId
SetConsoleTitleW
GetProcessShutdownParameters
FreeEnvironmentStringsW
RequestWakeupLatency
VirtualProtect
CompareStringA
GetConsoleCursorInfo
GetCPInfoExA
GetVersionExA
FindAtomW
GetWindowsDirectoryW
GetVersion
GetVolumeNameForVolumeMountPointW
DeleteFileW
FindActCtxSectionStringW
GetProfileSectionW
CommConfigDialogW
InterlockedIncrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetCommandLineA
GetStartupInfoA
HeapValidate
IsBadReadPtr
RaiseException
RtlUnwind
WideCharToMultiByte
MultiByteToWideChar
GetLastError
LCMapStringW
GetCPInfo
GetFileType
WriteFile
GetConsoleCP
GetProcAddress
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
DebugBreak
GetStdHandle
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
HeapDestroy
HeapCreate
HeapFree
VirtualFree
FlushFileBuffers
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
SetFilePointer
GetModuleHandleA
GetLocaleInfoW
CreateFileA
CloseHandle
user32
GetMessageTime
GetCursorInfo
Sections
.text Size: 289KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 193B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ