rmdbbn0[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rmdbbn0.zip
Size 5.9MB
Sample260703-addf4sdt6m
SHA256 cda337c5fe0922be083b943853f07ebe11beabbb40e4f2673edfa5057b2a1064
MD5 b51a89fba9117f5c1651adc6fc648138
SHA1 0bbb83dd4e9ca0943d8048b0d15890d31d590794
SHA512 ba054e2afdf33d08a5c0b18d7fec9e8c6d07472994631c842115d7043027c1c386835078272abccb4a413716e60ee92e73c5e7aebdcf3b6e0040c8af7dc20b4d
SSDEEP 98304:sRTmmhlyo8izbGzdyb8HlfhcmfOOq1NlhLDrvLw7HKmTexHAOHCMdQ59uptTrPQ:2i6zrb8FfemfOLNbrvs7HKmoAOH949yy
TLSH
T1BE56337E35F9D468298B37867CA17125FBB40C31A86029233AF5745FD085C8AF34E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f0af0042a4.exe

File Explorer

rmdbbn0.zip

.zip 5.9MB
f0af0042a4.exe

.exe 17.1MB

rmdbbn0.zip

SHA256 cda337c5fe0922be083b943853f07ebe11beabbb40e4f2673edfa5057b2a1064
MD5 b51a89fba9117f5c1651adc6fc648138
SHA1 0bbb83dd4e9ca0943d8048b0d15890d31d590794
SHA512 ba054e2afdf33d08a5c0b18d7fec9e8c6d07472994631c842115d7043027c1c386835078272abccb4a413716e60ee92e73c5e7aebdcf3b6e0040c8af7dc20b4d
SSDEEP 98304:sRTmmhlyo8izbGzdyb8HlfhcmfOOq1NlhLDrvLw7HKmTexHAOHCMdQ59uptTrPQ:2i6zrb8FfemfOLNbrvs7HKmoAOH949yy
TLSH
T1BE56337E35F9D468298B37867CA17125FBB40C31A86029233AF5745FD085C8AF34E79A
MD5 SHA1 SHA512 SSDEEP TLSH

f0af0042a4.exe

IMPHASH bc2613f38b98bc1b84e1d4b2baaec62d
SHA256 43bda481987135b6eea0a97d6125c2b0982d368ef90f2d5d982eca57bc75a552
MD5 f07d337f42138bb7f12acc9a99dfe772
SHA1 9a2e9a9d07eb58b5673570be1f5ae5d3936ccae6
SHA512 32ecee3a40af8c54187ca2a38c88bd1fd9150beea05b3483bde6d3dd9b7f46137e2e4de1021ce83aefbb34990bf7867bd84a4b25219bcca45131c8ae244867f4
SSDEEP 98304:xDCibVb7ozbMsdDquUWKpy3o0TksGXQX2isKq8wJX9ulnTrdntWkmzAcelK9411x:xDCUb7ApUo3o0TPGXQXtpl9TQzcQgX
TLSH
T1B2074A06B361C465D41A82388DD7C7AAAB717C91CF2283C736E5B36E1E377D12EB6601
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3165616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CheckTokenMembership DeregisterEventSource DuplicateTokenEx GetTokenInformation ImpersonateLoggedOnUser LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW RevertToSelf

bcrypt

BCryptGetProperty BCryptGenRandom BCryptEncrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptSetProperty BCryptDestroyHash BCryptImportKey BCryptImportKeyPair BCryptDestroyKey BCryptHashData BCryptExportKey

crypt32

PFXImportCertStore PFXExportCertStore CryptQueryObject CryptImportPublicKeyInfoEx2 CryptFormatObject CryptFindOIDInfo CryptDecodeObject CertVerifyTimeValidity CertVerifyCertificateChainPolicy CertSerializeCertificateStoreElement CertSaveStore CertOpenStore CertNameToStrW CertGetValidUsages CertGetNameStringW CertGetIntendedKeyUsage CertAddCertificateContextToStore CertAddCertificateLinkToStore CertCloseStore CertControlStore CertCreateCertificateChainEngine CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty

iphlpapi

GetNetworkParams GetAdaptersAddresses GetPerAdapterInfo if_nametoindex

kernel32

SetUnhandledExceptionFilter RtlUnwindEx InitializeSListHead RtlPcToFileHeader RaiseException FlsFree EncodePointer K32GetProcessMemoryInfo GetProcessGroupAffinity CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CreateDirectoryW CreateEventExW CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterW FindClose FindFirstFileExW FlushFileBuffers FlushViewOfFile FormatMessageW FreeLibrary GetCPInfo GetCPInfoExW GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemInfo GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GlobalMemoryStatusEx InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OpenThread QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadConsoleW ReadFile ResetEvent ResumeThread SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleOutputCP SetConsoleTitleW SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber

ncrypt

NCryptFreeObject NCryptGetProperty NCryptImportKey NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptDeleteKey

ole32

CoCreateGuid CoGetApartmentType CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CoWaitForMultipleHandles

ws2_32

WSAStartup WSASocketW WSASend bind ioctlsocket WSARecv WSAIoctl WSAGetOverlappedResult WSAEventSelect WSAConnect WSACleanup GetNameInfoW GetAddrInfoW shutdown setsockopt send select recv closesocket getsockopt getpeername FreeAddrInfoExW FreeAddrInfoW GetAddrInfoExW

api-ms-win-crt-heap-l1-1-0

free malloc calloc _set_new_mode _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr modf floor ceil

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp _stricmp strlen

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_cexit __p___wargv __p___argc abort _exit _register_thread_local_exe_atexit_callback terminate exit _initterm_e _crt_atexit _initterm _register_onexit_function _c_exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale