rh_0[.]9[.]0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
rh_0.9.0.exe
Size 494KB
Sample250416-3zalkaxtfv
SHA256 642aeebc65589ee43e09e3d4066e9519151031c43a7daa8dd6f4823fc804d27c
MD5 01670e3502fb191bc0d6f3590ad6ed89
SHA1 c22bd6859141af59062de7f68aff25177b3d56da
SHA512 2cf227cd722e68e98a87225cdeb22fcd66b4b6519ecb1e904805e60d15560b0a8b08da0f0f0e5ddcd69fc51cdc997e8e541306633296bb01eb9070bc78117960
SSDEEP 12288:Q5p1UZ32H10rH5ZVZEsh8ZskmY5a4JNXuOwhDy/K:Q5pOZGHOrH5RLG64JNXQ1g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rh_0.9.0.exe

File Explorer

rh_0.9.0.exe

.exe 494KB

rh_0.9.0.exe

IMPHASH 81dd082c3ea735ad5ba4cf627001ae92
SHA256 642aeebc65589ee43e09e3d4066e9519151031c43a7daa8dd6f4823fc804d27c
MD5 01670e3502fb191bc0d6f3590ad6ed89
SHA1 c22bd6859141af59062de7f68aff25177b3d56da
SHA512 2cf227cd722e68e98a87225cdeb22fcd66b4b6519ecb1e904805e60d15560b0a8b08da0f0f0e5ddcd69fc51cdc997e8e541306633296bb01eb9070bc78117960
SSDEEP 12288:Q5p1UZ32H10rH5ZVZEsh8ZskmY5a4JNXuOwhDy/K:Q5pOZGHOrH5RLG64JNXQ1g
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

358417

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile HeapSize CreateFileW DecodePointer SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP MapViewOfFile FindNextFileW FindFirstFileExW FindClose ReadConsoleW GetConsoleMode ReadFile HeapReAlloc GetFileType LCMapStringW HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetModuleFileNameW CreateFileMappingW CreateEventW WaitForSingleObject IsValidCodePage CloseHandle WriteFile GetStdHandle RaiseException EncodePointer LoadLibraryExW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress WriteConsoleW

user32

GetWindowLongA GetWindowTextLengthW GetWindowTextW EnableWindow InvalidateRect DialogBoxParamW GetWindowTextLengthA CheckDlgButton KillTimer GetDlgItem MapDialogRect CharUpperA LoadIconA SetCursor CharUpperW SetDlgItemTextA IsDlgButtonChecked MoveWindow IsWindowEnabled SetWindowTextA SendMessageA GetWindowTextA SetWindowLongA SetTimer ShowWindow LoadStringW DialogBoxParamA SetWindowTextW EndDialog SendMessageW ScreenToClient PostMessageA CharPrevA LoadStringA MessageBoxW LoadCursorA GetWindowRect

ole32

CoUninitialize CoInitialize

oleaut32

SysStringByteLen SysAllocString VariantCopy VariantClear

comctl32

ord17

comdlg32

GetOpenFileNameW GetOpenFileNameA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHGetMalloc