ropro-patcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ropro-patcher.exe
Size 5.2MB
Sample260509-radfdahs71
SHA256 46f5c8193c48a88e3852a85a3a6a22a178f593b62e9ad955f3fbc5f5bfbccdab
MD5 a45a9b8f355e4eba9bb96171f572b3ea
SHA1 87a8a3acad2b65db9e5ef978d795f4f5e3c89ea5
SHA512 5afa6388c7d1019eb713efaf4e0daf275e65553152cdab8b06ad253278733e7b1b7a84a99cd059c0cde3ed7d20bf9fe5c7eb3bae1cdc403c7f4b02ff1d933d1c
SSDEEP 49152:4ksMKU1of3gRlm2enekEWacjeQrLBNCF2Uw5qfzWfE1KlWNz3005xjYmGklytaj/:4id30+nGHHeecFTZOZaG/L1l3QdQE
TLSH
T15B463B217F5A9AEDC09AC074C24647726A7274CA0B35BAFF45C496783E25AF41F3C398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ropro-patcher.exe

File Explorer

ropro-patcher.exe

.exe 5.2MB

ropro-patcher.exe

IMPHASH 4d8950321ab17c0f8fcddaac66469a3b
SHA256 46f5c8193c48a88e3852a85a3a6a22a178f593b62e9ad955f3fbc5f5bfbccdab
MD5 a45a9b8f355e4eba9bb96171f572b3ea
SHA1 87a8a3acad2b65db9e5ef978d795f4f5e3c89ea5
SHA512 5afa6388c7d1019eb713efaf4e0daf275e65553152cdab8b06ad253278733e7b1b7a84a99cd059c0cde3ed7d20bf9fe5c7eb3bae1cdc403c7f4b02ff1d933d1c
SSDEEP 49152:4ksMKU1of3gRlm2enekEWacjeQrLBNCF2Uw5qfzWfE1KlWNz3005xjYmGklytaj/:4id30+nGHHeecFTZOZaG/L1l3QdQE
TLSH
T15B463B217F5A9AEDC09AC074C24647726A7274CA0B35BAFF45C496783E25AF41F3C398
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3322160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Users\stefa\Documents\GitHub\RoProPatcher\target\release\deps\ropro_patcher.pdb

ntdll

NtCancelIoFileEx NtReadFile RtlNtStatusToDosError RtlVirtualUnwind NtWriteFile NtDeviceIoControlFile NtCreateFile RtlLookupFunctionEntry RtlCaptureContext

kernel32

SetFileCompletionNotificationModes PostQueuedCompletionStatus lstrlenW GetQueuedCompletionStatusEx GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation CreateIoCompletionPort SetConsoleCursorPosition WaitForMultipleObjects GetCurrentProcessId SetHandleInformation ReleaseSRWLockShared Sleep GetModuleHandleA GetProcAddress AcquireSRWLockShared SetConsoleActiveScreenBuffer GetConsoleScreenBufferInfo GetStdHandle SetConsoleMode GetConsoleMode CreateFileW SetConsoleTextAttribute FillConsoleOutputCharacterA FillConsoleOutputAttribute WriteConsoleW ReadConsoleInputW GetNumberOfConsoleInputEvents SleepConditionVariableSRW ReleaseMutex FindClose GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread GetCurrentProcess GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW FileTimeToSystemTime GetCommandLineW SetFileInformationByHandle DuplicateHandle SetFilePointerEx WaitForSingleObject TerminateProcess WakeAllConditionVariable WakeConditionVariable HeapAlloc GetProcessHeap HeapFree CreateConsoleScreenBuffer HeapReAlloc WaitForSingleObjectEx LoadLibraryA CreateMutexA FindNextFileW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW FindFirstFileW GetFinalPathNameByHandleW TryAcquireSRWLockExclusive GetModuleHandleW FormatMessageW GetModuleFileNameW GetFullPathNameW AcquireSRWLockExclusive ReleaseSRWLockExclusive MultiByteToWideChar WideCharToMultiByte ReadConsoleW CreateThread TlsGetValue TlsSetValue CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemInfo IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead IsDebuggerPresent SetConsoleCursorInfo

ws2_32

ioctlsocket connect bind WSASocketW getsockname getpeername shutdown recv send WSASend setsockopt WSAIoctl closesocket WSAGetLastError WSAStartup WSACleanup freeaddrinfo getaddrinfo getsockopt

secur32

FreeCredentialsHandle FreeContextBuffer AcquireCredentialsHandleA AcceptSecurityContext DecryptMessage ApplyControlToken QueryContextAttributesW EncryptMessage InitializeSecurityContextW DeleteSecurityContext

crypt32

CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertOpenStore CertCloseStore CertDuplicateStore

advapi32

RegCloseKey SystemFunction036 RegQueryValueExW RegOpenKeyExW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

user32

ToUnicodeEx GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 memcpy memmove memcmp __current_exception memset _CxxThrowException __current_exception_context __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argc _register_thread_local_exe_atexit_callback _initialize_onexit_table _c_exit _cexit __p___argv _seh_filter_exe _set_app_type terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _crt_atexit exit _exit _register_onexit_function

api-ms-win-crt-math-l1-1-0

fmod pow __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale