rust[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rust.exe
Size 538KB
Sample260804-s2z9wsda67
SHA256 8a2ddd4ae0019bb18d8b37af8a013a159c9d6510012158969ed681db431919ae
MD5 528b9090abc968587a4d47512f6c9bbe
SHA1 d2d9e598bcfd13d9ecdf3f1da5aa776e49881eaa
SHA512 6bb2d8f39619c1655240e8af01d672d72a5fbfac409396797011eea6e74fd257aaf049384d53daa6d49137482d48b48aa6f33a63658490bf524a619b0aa48c41
SSDEEP 6144:PXD3TCUQqT8nDEYhYYfBQdMs6YFdOovWX6J0JkkwdQRq1n/hXjfWd/TZP7S+VoZd:PIegsOovWasGn/hXjf+1P7Hsd
TLSH
T18EC4AD46F36186DAD4AB947891A3E327F7713C5C0714C6CBB7F89E186BA72D02CA9341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rust.exe

File Explorer

rust.exe

.exe 538KB

rust.exe

IMPHASH 3c2681753a5df73e21d300fc94722235
SHA256 8a2ddd4ae0019bb18d8b37af8a013a159c9d6510012158969ed681db431919ae
MD5 528b9090abc968587a4d47512f6c9bbe
SHA1 d2d9e598bcfd13d9ecdf3f1da5aa776e49881eaa
SHA512 6bb2d8f39619c1655240e8af01d672d72a5fbfac409396797011eea6e74fd257aaf049384d53daa6d49137482d48b48aa6f33a63658490bf524a619b0aa48c41
SSDEEP 6144:PXD3TCUQqT8nDEYhYYfBQdMs6YFdOovWX6J0JkkwdQRq1n/hXjfWd/TZP7S+VoZd:PIegsOovWasGn/hXjf+1P7Hsd
TLSH
T18EC4AD46F36186DAD4AB947891A3E327F7713C5C0714C6CBB7F89E186BA72D02CA9341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ZIP\Desktop\งาน imgui\ชมพู\x64\Release\imgui dx11 3.pdb

kernel32

GetConsoleWindow LoadLibraryA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW IsDebuggerPresent TerminateProcess Sleep SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalUnlock WideCharToMultiByte Beep QueryPerformanceCounter FreeLibrary GetProcAddress GetCurrentProcess GlobalLock CreateThread QueryPerformanceFrequency GlobalFree GlobalAlloc GetTempPathA IsProcessorFeaturePresent MultiByteToWideChar

user32

DispatchMessageA GetWindowRect DestroyWindow keybd_event CreateWindowExW GetSystemMetrics UnregisterClassW ShowWindow GetAsyncKeyState SetWindowLongA GetWindowLongA SetWindowDisplayAffinity MoveWindow DefWindowProcA SetLayeredWindowAttributes TranslateMessage RegisterClassExW ScreenToClient GetCapture mouse_event LoadIconA PeekMessageA PostQuitMessage UpdateWindow GetKeyState LoadCursorA ClientToScreen TrackMouseEvent SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetForegroundWindow SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos

shell32

ShellExecuteA

msvcp140

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

urlmon

URLDownloadToFileA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmAssociateContextEx

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset _CxxThrowException memmove __current_exception_context __current_exception __C_specific_handler strstr __std_terminate __std_exception_copy __std_exception_destroy memcpy memchr memcmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _cexit terminate _seh_filter_exe _set_app_type _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _configure_narrow_argv __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _errno _crt_atexit _invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

_set_fmode _get_stream_buffer_pointers fread _fseeki64 fsetpos ungetc setvbuf __stdio_common_vsprintf _wfopen __p__commode fgetpos __stdio_common_vsscanf __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func fgetc ftell fwrite fputc

api-ms-win-crt-string-l1-1-0

strcpy_s strncmp strncpy strcmp

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-convert-l1-1-0

strtof strtol atof

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

powf cosf sinf sqrtf fmodf acosf __setusermatherr ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale