R3nzSkin.zip
- SHA256 ba7ec562a7d6b72e2e2e5c48c65a6665fade6bdbdbe73cb0010c33af7bed65cc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
R3nzSkin_Injector.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target R3nzSkin.zip
- Size 515KB
- Sample260506-e7qqraat9x
- SHA256 ba7ec562a7d6b72e2e2e5c48c65a6665fade6bdbdbe73cb0010c33af7bed65cc
- MD5 f3e11bafd4a2474fcaca52df1b79bc5c
- SHA1 ca3fcd4a1f73ea71b601c269474fb39269931970
- SHA512 38a9eb5e21f712d15cb9d60f1131e22a2c4cd91aa7972cb1c810824b0b015e466f10273df5b3edd13bb5826fc70729b3d8cdfe943131d0f728a0bde57045886f
- SSDEEP 12288:GGakvUBqC/plnup1872jRLeZGLFDL5o34wsmTVIpoyex2yBbf6i3XMAM6c:G5jBj/pLQZ9K4iupokU89
- TLSH T1EEB42347EC18AA47B53C1520E8C6935F50E7DC2C9BEE6B49B2F199F5DBC20C8D8642B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/R3nzSkin.dll unpack001/R3nzSkin_Injector.exe
File Explorer
-
R3nzSkin.zip.zip 515KB
-
R3nzSkin.dll.dll 735KB
-
R3nzSkin_Injector.exe.exe 299KB
R3nzSkin.dll
- IMPHASH 1ce67ebd85ff23eb60030be4583c2ac3
- SHA256 5e5be7d8aa3a96bfb2a534897b2502799448886f402bc3378d5305a36349b1e1
- MD5 58dd2bcc4e80b3a3505c21ff541e3924
- SHA1 d7803f8a5597607e2ad510c0d4165abbaa88bbbf
- SHA512 b434f5e77db8f641e3478b322ab41d22302d806ec9fc29021b3820f1d5650c2814c1ad24c13f4102623dffb389a1931c9c1460dda104fdd7acf0616a44d3d434
- SSDEEP 12288:NSAMUNbrPE8CFRB4H3tKGEXYSPqKPBmlFVBHeko6pYgpsojt7nnbSLTX:NxMURjC5eKGEBPDPovVZeiYKsOt7ny
- TLSH T194F4BF09B6E501F8D0B79139C95BAA07F7B1740807609AEF23E846692FA37E05E7F311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
383784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetModuleHandleW
VirtualQuery
ExitProcess
DisableThreadLibraryCalls
GetCurrentThread
CloseHandle
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
GetProcAddress
HeapReAlloc
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapAlloc
HeapFree
GetConsoleMode
GetConsoleOutputCP
QueryPerformanceFrequency
GlobalUnlock
WriteFile
FlushFileBuffers
GetFileType
GetStdHandle
WideCharToMultiByte
GlobalLock
GlobalAlloc
GlobalFree
IsValidCodePage
MultiByteToWideChar
GetFileSizeEx
GetModuleFileNameW
GetModuleHandleExW
FreeLibraryAndExitThread
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObjectEx
Sleep
InitOnceComplete
InitOnceBeginInitialize
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
CreateThread
ExitThread
RtlUnwind
user32
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
OpenClipboard
CallWindowProcW
SetWindowLongPtrW
GetAsyncKeyState
SetWindowLongW
MessageBoxA
ScreenToClient
GetCapture
ClientToScreen
IsChild
TrackMouseEvent
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
Name
.text
Size
553KB
Virtual Size
552KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=259, version=30795,
count=180, id=261, version=30795,
count=23, id=260, version=30795,
count=15, id=260, version=31616,
count=87, id=261, version=31616,
count=12, id=259, version=31616,
count=1, id=262, version=30795,
count=17, id=257, version=30795,
count=208, id=1, productName=Unmarked objects,
count=17, id=265, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
R3nzSkin_Injector.exe
- IMPHASH 2c3ed07dfb34c79124a4487410d8e0bd
- SHA256 ea034d7b08a538f827293c3b0742d4c178708afdfd0f45d47cad99967b311a97
- MD5 8af17734385f55dc58f1ca38bce22312
- SHA1 6983464a9c6391bdd1e7b0aa275acf0a49c12d76
- SHA512 61c076bd92de12fa0c48ca5e4b5ea263c3d4e39e9821bdabc98a84ed0d37d40065095e7ea08bfd35fd47d9fa27b7f6053992844044b9f5d6677ea7a19e25b024
- SSDEEP 6144:fj7Q2Fnv3OcLHF1ZVTc0/YxuQOPLnrU1ZE2pkLPVQW13fe0I2028fOTMK+epwMg3:fj7dOqZVTc0/YxvOPLnrU1ZE2pkLPVQe
- TLSH T159546DA9A3A20E66C79D23B7F51B42A8F33258C6771173B6C257C1263481349EDC6ED3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
99940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcp140
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
_Strcoll
_Strxfrm
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?id@?$collate@D@std@@2V0locale@2@A
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Xtime_get_ticks
_Query_perf_frequency
_Query_perf_counter
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?is@?$ctype@D@std@@QEBA_NFD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
_Thrd_sleep
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
_cexit
terminate
_beginthreadex
abort
_invalid_parameter_noinfo_noreturn
vcruntime140
__current_exception_context
__current_exception
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memcpy
__FrameUnwindFilter
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
__CxxQueryExceptionSize
strchr
memmove
kernel32
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
advapi32
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
api-ms-win-crt-stdio-l1-1-0
fgetc
_get_stream_buffer_pointers
fwrite
fclose
fflush
setvbuf
fsetpos
fgetpos
fread
_fseeki64
ungetc
fputc
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
srand
mscoree
_CorExeMain
Name
.text
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.nep
Size
1024B
Virtual Size
656B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=6, id=260, version=31616,
count=2, id=259, version=31616,
count=22, id=261, version=31616,
count=5, id=257, version=31616,
count=4, id=257, version=30795,
count=141, id=1, productName=Unmarked objects,
count=3, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=151,
count=1, id=258, version=31630,