rpy[.]exe | Triage™

General

Target
rpy.exe
Size 3.5MB
Sample260706-cs71dacz5q
SHA256 b22560327f5fa3ad439fe9924b82021850ce70fb00b6555b35b254cab0f39fb0
MD5 7cc50e891bc0712e4183b435e3431df5
SHA1 19d07ae57be0ccb82b75d36ada3bba2753f74abc
SHA512 b69f1b8345914f51e712fd2cdef207d72cdeb8494b9711b8d1f1ab21f5abb56c01848d62a0db4d0849bf44743afb24749228ce2b1aa668be6fbe6e71b159c5f8
SSDEEP 49152:Q+yVmwKlcTNvb61qdN6erzfFTFHz8n5y40XNSJmK7nYHbTdxJavPmexxC2636KFy:BCkZJCpmb
TLSH
T10C066C19A65800D8D1ABD1BDCE46D507EFB2BC4917A1CBCB2694630B1F737F41EBA221
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rpy.exe

File Explorer

rpy.exe

.exe 3.5MB

rpy.exe

IMPHASH 4c157bc37169e66c943321efa9ee4a59
SHA256 b22560327f5fa3ad439fe9924b82021850ce70fb00b6555b35b254cab0f39fb0
MD5 7cc50e891bc0712e4183b435e3431df5
SHA1 19d07ae57be0ccb82b75d36ada3bba2753f74abc
SHA512 b69f1b8345914f51e712fd2cdef207d72cdeb8494b9711b8d1f1ab21f5abb56c01848d62a0db4d0849bf44743afb24749228ce2b1aa668be6fbe6e71b159c5f8
SSDEEP 49152:Q+yVmwKlcTNvb61qdN6erzfFTFHz8n5y40XNSJmK7nYHbTdxJavPmexxC2636KFy:BCkZJCpmb
TLSH
T10C066C19A65800D8D1ABD1BDCE46D507EFB2BC4917A1CBCB2694630B1F737F41EBA221
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2383516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindClose FindNextFileW GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte HeapSize LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindFirstFileExW AreFileApisANSI CloseHandle GetModuleHandleW GetProcAddress InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW SetEnvironmentVariableW GetFileType ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx SetFilePointerEx SetStdHandle SetEndOfFile HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW RtlUnwind

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

821KB

Virtual Size

820KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

94KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rpy.exe

kernel32

generic