rd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rd.exe
Size 2.3MB
Sample260803-v7mbbsda73
SHA256 306765c2d228be7be6b1b473eeee50d4e07f13549447cf37bba50d2278f695a8
MD5 264224f12d1715ca4b1dba404f12c9a3
SHA1 f000905953c10a603334160b2d471e080f5ad660
SHA512 f06599e422f1a9c3d136238955292a864f24e288f45cf93d5669d1d94250024e05b5526d9146c3bb6e9a4c5e6008842144170054feed7ca474ae13b4777a339a
SSDEEP 49152:LQxZIJ2T/0Ervgn1MXXGfJoLuGNw/+HLXB/Pj:kuJ2TRkhoLaGr5b
TLSH
T197B5E042F2A542EDC5A78938C662D31BE7707804171487CBBBDD5AAA6F97AE01F7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rd.exe

File Explorer

rd.exe

.exe 2.3MB

rd.exe

IMPHASH 2ec9da10056ffa2ee2b0b924100b9f37
SHA256 306765c2d228be7be6b1b473eeee50d4e07f13549447cf37bba50d2278f695a8
MD5 264224f12d1715ca4b1dba404f12c9a3
SHA1 f000905953c10a603334160b2d471e080f5ad660
SHA512 f06599e422f1a9c3d136238955292a864f24e288f45cf93d5669d1d94250024e05b5526d9146c3bb6e9a4c5e6008842144170054feed7ca474ae13b4777a339a
SSDEEP 49152:LQxZIJ2T/0Ervgn1MXXGfJoLuGNw/+HLXB/Pj:kuJ2TRkhoLaGr5b
TLSH
T197B5E042F2A542EDC5A78938C662D31BE7707804171487CBBBDD5AAA6F97AE01F7D300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

346216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\yggyu\Desktop\FairGame Permanent Spoofer\x64\Release\Pikao_custom_work.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

advapi32

CryptHashData CryptReleaseContext CryptDestroyHash CryptCreateHash GetTokenInformation OpenProcessToken GetUserNameA CryptAcquireContextA CryptGetHashParam

kernel32

GetCurrentProcess GetEnvironmentVariableA WaitForSingleObject CreateToolhelp32Snapshot Sleep GetTempPathA GetLastError GetFileAttributesA Process32NextW DeleteFileA Process32FirstW CloseHandle ExitProcess CreateProcessA CreateDirectoryA GetExitCodeProcess GetModuleFileNameW LoadLibraryW GetModuleHandleW MultiByteToWideChar LoadLibraryA FreeLibrary WideCharToMultiByte GlobalLock SetThreadPriority CreateThread GetTickCount ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead QueryPerformanceCounter GetProcAddress GlobalUnlock QueryPerformanceFrequency GlobalAlloc GlobalFree

user32

GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow SetClipboardData DispatchMessageW SetWindowLongA GetClientRect PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetWindowRect MoveWindow SetCursor SetCapture LoadCursorW GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetKeyState

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ??Bios_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

urlmon

URLDownloadToFileA

winhttp

WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr memchr memcmp memcpy memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException strrchr longjmp memmove __intrinsic_setjmp __std_exception_copy __std_exception_destroy __std_terminate

api-ms-win-crt-stdio-l1-1-0

fflush fopen _popen fclose __p__commode ftell fseek fgets __stdio_common_vfprintf _set_fmode _pclose fwrite _wfopen __stdio_common_vsprintf _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fgetc fread __stdio_common_vsscanf fputc __acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _errno _invoke_watson

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-string-l1-1-0

strcmp _wcsicmp isalnum strncpy strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-convert-l1-1-0

strtol strtoll

api-ms-win-crt-math-l1-1-0

sqrtf fmodf sinf roundf ceilf acosf powf cosf __setusermatherr

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale