RBI[.]dll[.]exe | Triage™

General

Target
RBI.dll.exe
Size 54KB
Sample260709-s7c2jscy7k
SHA256 89f1f236a5fbc95e3540626caf9cdfe525bcd85789c4ac95c8b99e1781015a8c
MD5 c2129f59f43570484456038599bcf74b
SHA1 d3c429775900e927c44c81f52fd080ebede3abb6
SHA512 2491792eb74b4f3da10a75ab7cc7644f265f6713e320975b7dfff5001f4e184d1ae1de5ce199e6a18c7738aac20131362d876dc07e3551a6b36e84f21b7725e5
SSDEEP 1536:eHnEYEWlugauOXeCkPEbglZoEb7W01s0CpHzTr35rdS55szGCJOAaFVcnseS8E2e:ek9LaPZvM25K2USLMnu
TLSH
T13A430B0AF223FDAACDA191F3999ABDE518E0F4650131D2FAF45F8E74C121518DE9932C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RBI.dll.exe

File Explorer

RBI.dll.exe

.dll 54KB

RBI.dll.exe

IMPHASH 62c28c544b05b25ebd21e8e963590d4f
SHA256 89f1f236a5fbc95e3540626caf9cdfe525bcd85789c4ac95c8b99e1781015a8c
MD5 c2129f59f43570484456038599bcf74b
SHA1 d3c429775900e927c44c81f52fd080ebede3abb6
SHA512 2491792eb74b4f3da10a75ab7cc7644f265f6713e320975b7dfff5001f4e184d1ae1de5ce199e6a18c7738aac20131362d876dc07e3551a6b36e84f21b7725e5
SSDEEP 1536:eHnEYEWlugauOXeCkPEbglZoEb7W01s0CpHzTr35rdS55szGCJOAaFVcnseS8E2e:ek9LaPZvM25K2USLMnu
TLSH
T13A430B0AF223FDAACDA191F3999ABDE518E0F4650131D2FAF45F8E74C121518DE9932C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

??0OCefClientDlg ??0OCefClientDlg@@QEAA@PEAVCWnd@@KAEBVCRect@@@Z ??0OCefClientDlgBase ??0OCefClientDlgBase@@QEAA@PEAVOCefClientDelegateBase@client@@PEAVCWnd@@KAEBVCRect@@@Z ??0OCefClientVisitor ??0OCefClientVisitor@@QEAA@AEBV0@@Z ??0OCefClientVisitor@@QEAA@PEB_W@Z ??0OCefSimpleDlg ??0OCefSimpleDlg@@QEAA@PEAVCWnd@@KAEBVCRect@@@Z ??1OCefClientDlg ??1OCefClientDlg@@UEAA@XZ ??1OCefClientDlgBase ??1OCefClientDlgBase@@UEAA@XZ ??1OCefClientVisitor ??1OCefClientVisitor@@QEAA@XZ ??1OCefSimpleDlg ??1OCefSimpleDlg@@UEAA@XZ ??4OCefClientVisitor ??4OCefClientVisitor@@QEAAAEAV0@AEBV0@@Z ??_7OCefClientDlg ??_7OCefClientDlg@@6B@ ??_7OCefClientDlgBase ??_7OCefClientDlgBase@@6B@ ??_7OCefClientVisitor ??_7OCefClientVisitor@@6B@ ??_7OCefSimpleDlg ??_7OCefSimpleDlg@@6B@ ??_FOCefClientDlg ??_FOCefClientDlg@@QEAAXXZ ??_FOCefSimpleDlg ??_FOCefSimpleDlg@@QEAAXXZ ?AfterVisit ?AfterVisit@OCefClientVisitor@@UEAAXXZ ?CefGetRunningSettings ?CefGetRunningSettings@@YAXAEAURUNNING_SETTINGS@@@Z ?CefGetTaskMessageId ?CefGetTaskMessageId@@YAAEAIXZ ?CefMainprocessClose ?CefMainprocessClose@@YAXXZ ?CefMainprocessInit ?CefMainprocessInit@@YAHXZ ?CefMainprocessPrepareClose ?CefMainprocessPrepareClose@@YA_NPEAUHWND__@@@Z ?CefOnThemeChange ?CefOnThemeChange@@YAXK@Z ?CefRunTaskMessage ?CefRunTaskMessage@@YA_J_K_J@Z ?CefSetRunningSettings ?CefSetRunningSettings@@YAXAEBURUNNING_SETTINGS@@@Z ?CefSubprocesswWinMain ?CefSubprocesswWinMain@@YAHPEAUHINSTANCE__@@0PEA_WH@Z ?DetachParent ?DetachParent@OCefClientDlgBase@@UEAAXXZ ?DispExtCall ?DispExtCall@OCefClientDlg@@UEAA?AUtagVARIANT@@AEAU2@0000@Z ?DispGetExtCalls ?DispGetExtCalls@OCefClientDlg@@UEAA?AUtagVARIANT@@XZ ?DispGetLang ?DispGetLang@OCefClientDlg@@UEBA?AUtagVARIANT@@XZ ?DispGetOLabSettings ?DispGetOLabSettings@OCefClientDlgBase@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?DispLoadStates ?DispLoadStates@OCefClientDlg@@UEAA?AUtagVARIANT@@AEAU2@@Z ?DispSaveStates ?DispSaveStates@OCefClientDlg@@UEAAXAEAUtagVARIANT@@0@Z ?DispSetRes ?DispSetRes@OCefClientDlgBase@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAV_variant_t@@@Z ?DoClose ?DoClose@OCefClientDlgBase@@QEAA_N_N0@Z ?DoModal ?DoModal@OCefClientDlgBase@@UEAA_JXZ ?DoOCmd ?DoOCmd@OCefClientDlgBase@@UEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?ExecuteJavaScript ?ExecuteJavaScript@OCefClientDlgBase@@QEAA_NPEBD@Z ?GetBrowserWindowHandle ?GetBrowserWindowHandle@OCefClientDlgBase@@QEAAPEAUHWND__@@XZ ?GetDelegate ?GetDelegate@OCefClientDlgBase@@QEAAPEAVOCefClientDelegateBase@client@@XZ ?GetFileName ?GetFileName@OCefClientVisitor@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ ?GetHttpStatusCode ?GetHttpStatusCode@OCefClientDlgBase@@QEAAHXZ ?GetLifeSpanDelegate ?GetLifeSpanDelegate@OCefClientDlgBase@@QEAAPEAVOCefClientLifeSpanDelegate@1@XZ ?GetMessageMap ?GetMessageMap@OCefClientDlgBase@@MEBAPEBUAFX_MSGMAP@@XZ ?GetSourceToSave ?GetSourceToSave@OCefClientDlgBase@@QEAAHPEB_W@Z ?GetSourceToSave@OCefClientDlgBase@@QEAAHV?$shared_ptr@VOCefClientVisitor@@@std@@@Z ?GetThisMessageMap ?GetThisMessageMap@OCefClientDlgBase@@KAPEBUAFX_MSGMAP@@XZ ?GetUrl ?GetUrl@OCefClientDlgBase@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?LoadUrl ?LoadUrl@OCefClientDlgBase@@QEAAXPEBD@Z ?OnActivate ?OnActivate@OCefClientDlgBase@@IEAAXIPEAVCWnd@@H@Z ?OnBrowserCreated ?OnBrowserCreated@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnCefClose ?OnCefClose@OCefClientDlgBase@@QEBAHXZ ?OnClose ?OnClose@OCefClientDlgBase@@IEAAXXZ ?OnDevToolsMethodMap ?OnDevToolsMethodMap@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnDevToolsMethodResult ?OnDevToolsMethodResult@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnEnable ?OnEnable@OCefClientDlgBase@@IEAAXH@Z ?OnEraseBkgnd ?OnEraseBkgnd@OCefClientDlgBase@@IEAAHPEAVCDC@@@Z ?OnInitCefDialog ?OnInitCefDialog@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnInitDialog ?OnInitDialog@OCefClientDlgBase@@MEAAHXZ ?OnLoadEnd ?OnLoadEnd@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnLoadStart ?OnLoadStart@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnMouseEvent ?OnMouseEvent@OCefClientDlgBase@@MEAA_J_K_J@Z ?OnMove ?OnMove@OCefClientDlgBase@@IEAAXHH@Z ?OnOCmd ?OnOCmd@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnPreKeyEvent ?OnPreKeyEvent@OCefClientDlgBase@@MEAA_J_K_J@Z ?OnQuery ?OnQuery@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnSetFocus ?OnSetFocus@OCefClientDlgBase@@IEAAXPEAVCWnd@@@Z ?OnSetLoadingState ?OnSetLoadingState@OCefClientDlgBase@@IEAA_J_K_J@Z ?OnSize ?OnSize@OCefClientDlgBase@@IEAAXIHH@Z ?OnZoomLevel ?OnZoomLevel@OCefClientDlgBase@@QEAAXNH@Z ?PostCaptureScreenshot ?PostCaptureScreenshot@OCefClientDlgBase@@QEAAHV?$function@$$A6AXPEAVOCefClientDlgBase@@PEBD@Z@std@@@Z ?PostNcDestroy ?PostNcDestroy@OCefClientDlgBase@@MEAAXXZ ?PreTranslateMessage ?PreTranslateMessage@OCefClientDlgBase@@MEAAHPEAUtagMSG@@@Z ?Print ?Print@OCefClientDlgBase@@QEAAHXZ ?PrintToPDF ?PrintToPDF@OCefClientDlgBase@@QEAAH_NAEBUSTPdfSettings@@V?$function@$$A6A_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z@std@@@Z ?ReLoad ?ReLoad@OCefClientDlgBase@@QEAAXXZ ?ReloadIgnoreCache ?ReloadIgnoreCache@OCefClientDlgBase@@QEAAXXZ ?SaveAsHTML ?SaveAsHTML@OCefClientDlgBase@@UEAAXPEBDPEB_W@Z ?SetSelfDestroy ?SetSelfDestroy@OCefClientDlgBase@@IEAAX_N@Z ?__autoclassinit2 ?__autoclassinit2@OCefClientDlg@@QEAAX_K@Z ?__autoclassinit2@OCefClientDlgBase@@QEAAX_K@Z ?__autoclassinit2@OCefSimpleDlg@@QEAAX_K@Z sub_a5pt_33 sub_a7dh_70 sub_aet1_14 sub_avvl_35 sub_azbf_90 sub_bjfs_81 sub_c3eo_69 sub_ce3i_38 sub_cm0e_86 sub_d6t6_73 sub_dc2z_57 sub_dqao_19 sub_e2qw_66 sub_ersb_18 sub_ex70_21 sub_ex9a_25 sub_f6tl_75 sub_fesj_71 sub_fh6t_9 sub_fw3g_8 sub_g12r_30 sub_g5br_39 sub_g8dd_78 sub_gac5_23 sub_gley_1 sub_h3jy_84 sub_h5an_11 sub_h6l0_68 sub_h9wa_46 sub_hn5w_7 sub_i41h_15 sub_i51f_85 sub_iihz_43 sub_ion6_61 sub_iyix_82 sub_jdwf_76 sub_jk3v_91 sub_k1k0_22 sub_k46x_51 sub_k750_24 sub_kc0g_47 sub_kdns_48 sub_kjk2_10 sub_kpl8_4 sub_ksga_6 sub_l505_12 sub_li1u_79 sub_lkli_20 sub_lq2p_88 sub_ls2k_65 sub_lwws_3 sub_m5ra_44 sub_m8hx_2 sub_ma1l_49 sub_mny3_63 sub_mt3z_83 sub_nsoi_37 sub_nu7j_50 sub_pd6a_31 sub_ppsc_74 sub_q1nk_27 sub_qc2m_89 sub_qfp0_29 sub_r4kh_5 sub_r8f1_52 sub_riwu_60 sub_rjs0_17 sub_rzbu_40 sub_sr8u_36 sub_ssht_77 sub_svqr_87 sub_sz0c_0 sub_tiw3_45 sub_tk3l_41 sub_tqah_64 sub_u81c_62 sub_udg8_53 sub_utyz_67 sub_v4jm_42 sub_vchz_55 sub_vy7v_13 sub_w3zv_16 sub_w5fh_56 sub_wymw_72 sub_xekj_28 sub_xv14_34 sub_y27n_92 sub_y6q3_54 sub_yarn_80 sub_yg5v_59 sub_yi59_26 sub_z5s7_58 sub_z993_32

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

RBI.dll.exe

advapi32

gdi32

iphlpapi

kernel32

msvcrt

shell32

user32

ws2_32

generic

Sharing

General

Malware Config

Signatures

File Explorer

RBI.dll.exe

advapi32

gdi32

iphlpapi

kernel32

msvcrt

shell32

user32

ws2_32

generic