ROTK[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ROTK.exe
Size 2.7MB
Sample260623-mc7psaby9n
SHA256 0787cc532d703b337b784e8d2abae784a0f5f784992aaa9c63dc74d63d0cab3b
MD5 cbb9c8a03dab5de37e8fe12b32d38700
SHA1 27a36d3aa3d1bb7c9d55131ea8f087f8a53cf02b
SHA512 c3eedbb179da0480d2cd60d6351fc29ae4364ea17a5cb20fc693d1ae1c65331e33aecec0577ca6da7830b886f45754f9ad75c59c9fcf9344032e51bf48dbd87e
SSDEEP 49152:yXq3920gCQutAcra1py8xUfKf1EAi1U5LSD/3RHfz7mDDx9/CrFm2I7bGclhNpVl:y639//tA0Apy8xUfKf1EAiqSD/3R/2F
TLSH
T167D5D0C1D34780B7C49612B974AE3776DE381E4E633E821B6BA0E955D8107B0F3E926D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ROTK.exe

File Explorer

ROTK.exe

.exe 2.7MB

ROTK.exe

IMPHASH 718a59bbac5fbdc9b72ae7944819b944
SHA256 0787cc532d703b337b784e8d2abae784a0f5f784992aaa9c63dc74d63d0cab3b
MD5 cbb9c8a03dab5de37e8fe12b32d38700
SHA1 27a36d3aa3d1bb7c9d55131ea8f087f8a53cf02b
SHA512 c3eedbb179da0480d2cd60d6351fc29ae4364ea17a5cb20fc693d1ae1c65331e33aecec0577ca6da7830b886f45754f9ad75c59c9fcf9344032e51bf48dbd87e
SSDEEP 49152:yXq3920gCQutAcra1py8xUfKf1EAi1U5LSD/3RHfz7mDDx9/CrFm2I7bGclhNpVl:y639//tA0Apy8xUfKf1EAiqSD/3R/2F
TLSH
T167D5D0C1D34780B7C49612B974AE3776DE381E4E633E821B6BA0E955D8107B0F3E926D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1128602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\EAThirdPerson\lotr\rotk\code\Project\VisualStudio\Win\EN\ROTK_EN_Fin_Win_DotNet.pdb

kernel32

GetUserDefaultLangID WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA LocalFree FormatMessageA GetLastError GetSystemTime QueryPerformanceCounter QueryPerformanceFrequency SetEvent ReadFile SetFilePointer ResetEvent WaitForSingleObjectEx GetFileAttributesA CloseHandle GetFileInformationByHandle GetCurrentDirectoryA CreateFileA SetThreadPriority CreateThread CreateEventA WritePrivateProfileSectionA GetPrivateProfileSectionA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep GetCurrentThreadId CreateMutexA GetLocalTime GetFullPathNameA CreateDirectoryA RtlUnwind HeapAlloc HeapFree DeleteFileA GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersionExA LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetSystemDefaultLangID TerminateProcess GetCurrentProcess HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr UnhandledExceptionFilter WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetACP GetOEMCP GetCPInfo GetLocaleInfoA VirtualProtect GetSystemInfo VirtualQuery FlushFileBuffers GetCurrentProcessId GetSystemTimeAsFileTime SetStdHandle HeapSize SetEndOfFile IsProcessorFeaturePresent OutputDebugStringA LocalAlloc InterlockedExchange CompareStringW CompareStringA GetTimeZoneInformation IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime FindClose RaiseException GetModuleFileNameA LoadLibraryA GetProcAddress FreeLibrary ExitProcess GetTickCount SetEnvironmentVariableA

user32

MapVirtualKeyA MapVirtualKeyExA DefWindowProcA SetCursor PeekMessageA TranslateMessage GetSystemMetrics LoadCursorA DispatchMessageA LoadStringA LoadIconA RegisterClassExA CreateWindowExA ShowWindow SetForegroundWindow UpdateWindow AdjustWindowRect SetWindowPos PostQuitMessage MessageBoxA GetKeyboardLayout

advapi32

RegCloseKey RegCreateKeyExA RegQueryValueExA RegOpenKeyExA RegOpenKeyA RegSetValueExA

shell32

SHGetSpecialFolderPathA

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

124KB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

96KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.mortal

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

stxt371

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

ROTK.exe

kernel32

user32

advapi32

shell32

generic