rascal[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rascal.dll
Size 24.2MB
Sample260707-e2q5bshx71
SHA256 51b2b99c98a1c3251169666c9d2a233644606e5e581faf5f023e214a865b3ad1
MD5 d1562dbf4d8a24ae194331fa422c0e25
SHA1 28c9f691ef25942147d316b35b857cb23bd9f050
SHA512 288b9325e242355bcfc4e3d0b3359295e53e39ef2cb3475a94b4acccf0ac6551531e62c934b0bb4cb946e773508540963abfda7abb1a78c5f489767a8f25b37f
SSDEEP 786432:7JZsyfxdJs+2Q8J/X+ZOy0yA0cjqcnF8A4r:gyS+Q40d0cjqc14r
TLSH
T15447339E2DCB40EED9C11CB0A7176BE703B3D2954ACD4C3569C17949B0E2FB6206E987
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
rascal.dll

File Explorer

rascal.dll

.dll 24.2MB

rascal.dll

IMPHASH 7877fc1e99db484e17c092dd6570630f
SHA256 51b2b99c98a1c3251169666c9d2a233644606e5e581faf5f023e214a865b3ad1
MD5 d1562dbf4d8a24ae194331fa422c0e25
SHA1 28c9f691ef25942147d316b35b857cb23bd9f050
SHA512 288b9325e242355bcfc4e3d0b3359295e53e39ef2cb3475a94b4acccf0ac6551531e62c934b0bb4cb946e773508540963abfda7abb1a78c5f489767a8f25b37f
SSDEEP 786432:7JZsyfxdJs+2Q8J/X+ZOy0yA0cjqcnF8A4r:gyS+Q40d0cjqc14r
TLSH
T15447339E2DCB40EED9C11CB0A7176BE703B3D2954ACD4C3569C17949B0E2FB6206E987
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3a:a2:bf:57:49:d2:3f:75:72:6b:28:aa:d9:0f:59:09:9a:14:17:37

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Rascal-AntiCheat

Chains

Jul 6, 2026

CN=Rascal-AntiCheat

Subject

CN=Rascal-AntiCheat

Serial Number

64:57:e4:f4:2e:0b:45:96:4f:20:ce:a7:c1:f8:a4:53

Issuer

CN=Rascal-AntiCheat

Key Usages

KeyUsageDigitalSignature

Timespan

Jul 6, 2026 - Jul 6, 2027

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

38112584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA Process32FirstW CreateThread GetThreadContext CreateProcessW CreateEventA AddVectoredExceptionHandler VirtualAlloc OpenEventA FindFirstFileA FindFirstFileExW GetFullPathNameW FindNextFileA ResumeThread OpenMutexA QueryFullProcessImageNameA GetThreadId OpenFileMappingA SetProcessWorkingSetSize SetThreadContext ReadFile WriteFile Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetFileAttributesExW GetActiveProcessorCount Module32FirstW ReplaceFileW Module32NextW K32EnumProcesses LocalFree RemoveVectoredExceptionHandler GetSystemFirmwareTable K32GetDeviceDriverBaseNameA GetNativeSystemInfo EnumSystemFirmwareTables TerminateThread GetModuleHandleExW K32GetProcessImageFileNameA QueryDosDeviceA SuspendThread GetExitCodeThread GetFinalPathNameByHandleA K32GetModuleFileNameExA GetFileAttributesA DeleteFileW GetLogicalDriveStringsA WTSGetActiveConsoleSessionId GetCommandLineW EnterCriticalSection DisableThreadLibraryCalls GetModuleFileNameW FindNextFileW CreateDirectoryW WriteConsoleW SetEndOfFile SetStdHandle GetCurrentDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetModuleHandleExA IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlushFileBuffers SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW FreeLibraryAndExitThread SetConsoleCtrlHandler ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue SetEvent TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwind SleepConditionVariableCS Process32NextW QueueUserWorkItem VirtualProtect GetFileSizeEx GetModuleFileNameA GetCurrentThread OpenThread CreateProcessA GetThreadTimes Process32Next CreateToolhelp32Snapshot OpenProcess WaitForSingleObject Thread32First Thread32Next K32GetModuleFileNameExW Process32First VirtualQuery WideCharToMultiByte lstrlenW IsWow64Process CreateFileMappingW GetSystemWow64DirectoryW GetSystemDirectoryW GetCurrentProcess GetModuleHandleW Sleep GetFileAttributesW GetVolumeInformationW GetProcessId CreateFileW FindClose FindFirstFileW CreateFileA DeviceIoControl K32GetDeviceDriverFileNameW WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle VerifyVersionInfoW VerSetConditionMask K32EnumDeviceDrivers GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc GetEnvironmentVariableA MoveFileExA InitializeConditionVariable SleepEx SetLastError VirtualFree FlushInstructionCache HeapCreate RaiseException OutputDebugStringW GetCPInfo CompareStringEx HeapReAlloc LCMapStringEx GetLocaleInfoEx EncodePointer HeapSize InitializeCriticalSectionEx HeapFree WaitForSingleObjectEx WakeConditionVariable GetTickCount64 TryAcquireSRWLockExclusive QueryPerformanceFrequency GetStringTypeW FormatMessageA ExitThread DuplicateHandle CreateMutexA GetTempPathW InitializeCriticalSection LeaveCriticalSection TlsGetValue GetUserDefaultLocaleName GetProcAddress GetModuleHandleA GetTickCount MapViewOfFile GetCurrentProcessId CreateFileMappingA CloseHandle GetLastError GetACP ReleaseSRWLockExclusive MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive UnmapViewOfFile

user32

SetWindowLongA IsWindow EnumChildWindows IsWindowVisible GetWindowThreadProcessId PeekMessageA TranslateMessage GetWindowTextA PostThreadMessageA GetClassNameA DispatchMessageA GetMessageA GetWindowRect GetCursorPos KillTimer GetClientRect SystemParametersInfoA LoadIconA SendMessageA CreateWindowExA RegisterClassA GetMonitorInfoA ValidateRect SetTimer ShowWindow CreateWindowExW DestroyWindow LoadCursorA MonitorFromPoint SetWindowsHookExA GetWindowLongA UnhookWindowsHookEx EnumWindows DefWindowProcA

advapi32

OpenServiceW QueryServiceStatusEx StartServiceA ChangeServiceConfigA OpenSCManagerA CloseServiceHandle RegOpenKeyExA GetUserNameA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges GetTokenInformation SetKernelObjectSecurity SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorA RegOpenKeyW RegGetValueW RegOpenKeyExW RegEnumKeyExW CryptReleaseContext DeregisterEventSource CryptAcquireContextA CryptGenRandom ControlService CryptCreateHash CryptHashData ReportEventA CryptDestroyHash RegisterEventSourceA CryptGetHashParam OpenServiceA

shell32

SHFileOperationW

ole32

CreateStreamOnHGlobal CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantClear SysStringLen SysFreeString VariantInit

wevtapi

EvtQuery EvtClose EvtNext EvtRender

dbghelp

StackWalk64 SymInitialize SymFunctionTableAccess64 SymGetModuleBase64

bcrypt

BCryptFinishHash BCryptGetProperty BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGenRandom BCryptDestroyHash BCryptHashData BCryptOpenAlgorithmProvider

ntdll

NtQueryInformationThread RtlCreateUserThread NtQueryInformationProcess RtlAdjustPrivilege NtOpenProcessToken NtDuplicateObject NtOpenProcess NtQuerySystemInformation NtAdjustPrivilegesToken NtProtectVirtualMemory

wtsapi32

WTSSendMessageA

version

VerQueryValueA GetFileVersionInfoSizeExW GetFileVersionInfoExW

wintrust

CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminAcquireContext CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle WinVerifyTrust

iphlpapi

GetAdaptersInfo GetAdaptersAddresses GetIfTable2 FreeMibTable SendARP if_nametoindex

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW

ws2_32

WSACloseEvent send getsockopt WSAEnumNetworkEvents inet_addr WSACreateEvent WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError ntohs WSAStartup accept bind closesocket connect getpeername gethostname ioctlsocket sendto recvfrom htonl listen freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl getsockname htons recv setsockopt socket WSASetLastError WSACleanup

mpr

WNetEnumResourceA WNetOpenEnumA

discord_game_sdk

DiscordCreate

crypt32

CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertOpenStore CertGetNameStringA CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertFreeCTLContext CertFindExtension CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertEnumCertificatesInStore CertAddCertificateContextToStore CertFreeCertificateContext CryptMsgClose

gdiplus

GdipCloneBrush GdipDeleteGraphics GdipDeleteFont GdipGetImageWidth GdipCreateSolidFill GdipCreateFont GdipDrawImageRectI GdipFree GdipDeleteBrush GdipCreateFontFamilyFromName GdipGetImageHeight GdipDeleteFontFamily GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipDisposeImage GdipGetGenericFontFamilySansSerif GdipCreateFromHWND GdipDrawString GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipCreateFromHWNDICM

secur32

InitSecurityInterfaceA

Name

.text

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

15.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

24.2MB

Virtual Size

24.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rascal.dll

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

wevtapi

dbghelp

bcrypt

ntdll

wtsapi32

version

wintrust

iphlpapi

setupapi

ws2_32

mpr

discord_game_sdk

crypt32

gdiplus

secur32

generic