rl_63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349

Sharing

Copy URL Twitter E-mail

General

Target
rl_63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349
Size 968KB
Sample250702-dtxfpsdq7w
SHA256 63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349
MD5 1247bbf35b7f65b0421960f7cb33ee8e
SHA1 1df090cccbe86aaa055474f46d3cca40f530a70c
SHA512 dea680f6f7f8c0698081111983e9153a709c1d0b438633535e8092b56d9e7113a763bee3fcccf9f2aa869975586d8bfdf917f1e5d08cdff8858536a44beb19e9
SSDEEP 24576:jac2RLuQZ1MHbVbQsatx4G8Icsatx4G8I:g2bVUsatx4GVcsatx4GV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rl_63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349

File Explorer

rl_63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349

.exe 968KB

rl_63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349

IMPHASH 74fea8d9720dbfeca2a3ee9f97393036
SHA256 63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349
MD5 1247bbf35b7f65b0421960f7cb33ee8e
SHA1 1df090cccbe86aaa055474f46d3cca40f530a70c
SHA512 dea680f6f7f8c0698081111983e9153a709c1d0b438633535e8092b56d9e7113a763bee3fcccf9f2aa869975586d8bfdf917f1e5d08cdff8858536a44beb19e9
SSDEEP 24576:jac2RLuQZ1MHbVbQsatx4G8Icsatx4G8I:g2bVUsatx4GVcsatx4GV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW CreateThread DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeConsole FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

gdi32

BitBlt CreateCompatibleDC DeleteDC DeleteObject SelectObject TextOutA

user32

BeginPaint CreateWindowExA DefWindowProcW DispatchMessageW EndPaint GetMessageW LoadCursorW MessageBoxA MessageBoxW PostQuitMessage RegisterClassExA ShowWindow TranslateMessage UpdateWindow

Name

.text

Size

456KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.world

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.world

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

756B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rl_63d9d59c9f36e2496a5842f5fba7a171c270d17319271d6685afda7c38417349

kernel32

gdi32

user32

generic