r6od[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
r6od.exe
Size 66KB
Sample260508-tyaeqset3j
SHA256 104d56d5c388094a93c9e4e48f15e6a4e37f98f3a963720321c9d674005acf5a
MD5 76d01fdd50c688cc24c703b874e1e388
SHA1 db826cdb2f11c13e8c3c3a8bf3c94f1f97d248d0
SHA512 76225ca84ba7a4367ad5195e8135fe372c3bc2359804a91835265bb3d1102bb293cd9c920e64e5078b0f26f2ecba0b6641396bba097cfab1fde605807962334a
SSDEEP 768:5DjODDfxY7/gbTQwkzq1zOtrDwRisgaMU0GFD4K+RavIiLdxCgpcSPIUgo3vmAOL:5PODDfMg0eOdwm/XKUaLLnAUgYmnAb
TLSH
T1C0631B27AE16106EE259C978DA878D06DB717C8687D0B7CF57C04DE20E66AE09F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
r6od.exe

File Explorer

r6od.exe

.exe 66KB

r6od.exe

IMPHASH 387607fbd5c446023c5254f30b54e8b7
SHA256 104d56d5c388094a93c9e4e48f15e6a4e37f98f3a963720321c9d674005acf5a
MD5 76d01fdd50c688cc24c703b874e1e388
SHA1 db826cdb2f11c13e8c3c3a8bf3c94f1f97d248d0
SHA512 76225ca84ba7a4367ad5195e8135fe372c3bc2359804a91835265bb3d1102bb293cd9c920e64e5078b0f26f2ecba0b6641396bba097cfab1fde605807962334a
SSDEEP 768:5DjODDfxY7/gbTQwkzq1zOtrDwRisgaMU0GFD4K+RavIiLdxCgpcSPIUgo3vmAOL:5PODDfMg0eOdwm/XKUaLLnAUgYmnAb
TLSH
T1C0631B27AE16106EE259C978DA878D06DB717C8687D0B7CF57C04DE20E66AE09F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\1337\Downloads\as promised\as promised\R6-Cheat-Dumper-main\R6-Cheat-Dumper-main\r6dumper\x64\Release\r6od.pdb

kernel32

lstrlenW DeviceIoControl RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleW IsDebuggerPresent GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

user32

FindWindowA GetWindowThreadProcessId

ntdll

RtlInitUnicodeString NtCreateFile

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException memcmp __std_terminate __std_exception_copy __std_exception_destroy memcpy memset __C_specific_handler __current_exception_context memmove

api-ms-win-crt-stdio-l1-1-0

fsetpos fwrite fread ungetc __p__commode __stdio_common_vfprintf fgetc _set_fmode fclose fflush _get_stream_buffer_pointers __acrt_iob_func fputc setvbuf fgetpos _fseeki64

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _beginthreadex __p___argc _seh_filter_exe _cexit _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _initialize_narrow_environment _invoke_watson terminate _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit _c_exit _set_app_type __p___argv

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale