roulette-bridge-windows-amd64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
roulette-bridge-windows-amd64.exe
Size 8.9MB
Sample260731-ftdppsvand
SHA256 64d9b9e36c682c8306bb3099211d6544e59bfb6df373eebc8851469c4ae50b19
MD5 7e24fbeedd9d99a3c4400d5bf1b12c1b
SHA1 1ede0f46bbad563a08b5b9306a00ad6d653cb54c
SHA512 aba7b9ce50956289780e8c5f3c76fd147d74405f13ac052b6bbefd7e1ff0808565e761adbfff13b7cd25982f5631293cd7c7bb8b4cf93e61a4573fcc0e48d34c
SSDEEP 98304:CKgNnv3EZTGdKBgF8uUh56idR/LgV6PvIZbfwE++JuGmtt:CpwCV8vvjPvWuGm
TLSH
T124965B43F25291ECC16FC178835AA632FA757CCA09307EBF16E497312E65E905B1DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
roulette-bridge-windows-amd64.exe

File Explorer

roulette-bridge-windows-amd64.exe

.exe 8.9MB

roulette-bridge-windows-amd64.exe

IMPHASH 2cfae64f436b4f846bff2e2b87f87623
SHA256 64d9b9e36c682c8306bb3099211d6544e59bfb6df373eebc8851469c4ae50b19
MD5 7e24fbeedd9d99a3c4400d5bf1b12c1b
SHA1 1ede0f46bbad563a08b5b9306a00ad6d653cb54c
SHA512 aba7b9ce50956289780e8c5f3c76fd147d74405f13ac052b6bbefd7e1ff0808565e761adbfff13b7cd25982f5631293cd7c7bb8b4cf93e61a4573fcc0e48d34c
SSDEEP 98304:CKgNnv3EZTGdKBgF8uUh56idR/LgV6PvIZbfwE++JuGmtt:CpwCV8vvjPvWuGm
TLSH
T124965B43F25291ECC16FC178835AA632FA757CCA09307EBF16E497312E65E905B1DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1307552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CancelIo CancelIoEx CloseHandle CompareStringOrdinal ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreateIoCompletionPort CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNamedPipeInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList LeaveCriticalSection LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RegisterWaitForSingleObject RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx __C_specific_handler lstrlenW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fflush fwrite

api-ms-win-crt-string-l1-1-0

strlen strncmp

bcryptprimitives

ProcessPrng

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

userenv

GetUserProfileDirectoryW

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

roulette-bridge-windows-amd64.exe

kernel32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

bcryptprimitives

api-ms-win-crt-math-l1-1-0

ntdll

api-ms-win-core-synch-l1-2-0

userenv

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

bcrypt

advapi32

generic