timeless-rust[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
timeless-rust.exe
Size 2.5MB
Sample260804-sx818sch74
SHA256 70802f3ce70842220d234f0f1b6be4e88dca8d19174ddd3b22bd3a2e2146f908
MD5 2b2ce7d2da6da7c25b7ce441019b0a97
SHA1 e400cc5ba0b6d4c766f86505a0cdb4c0653b64dc
SHA512 cd5ae0837236c849543d48e8734b34190f7ac872ee133618c41979b34ffd77d8e3aa208d692eca0640d97786efbd49032120ecdb59852257206e980e8babea1a
SSDEEP 49152:PHjKafwWzMQEIn34JAZtB9TzAob0sciC/v2A7ZuBvTzA4bKPnPQURoUT:fjK3FATBe3/v2A7ZuBvTzd2
TLSH
T14EC59E4AD6A901E8C576C17CC60B9617F77134480331EBEB57E04A661FE3BE1A7BA702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
timeless-rust.exe

File Explorer

timeless-rust.exe

.exe 2.5MB

timeless-rust.exe

IMPHASH 239456fef08ef86f7e71503463b2cf75
SHA256 70802f3ce70842220d234f0f1b6be4e88dca8d19174ddd3b22bd3a2e2146f908
MD5 2b2ce7d2da6da7c25b7ce441019b0a97
SHA1 e400cc5ba0b6d4c766f86505a0cdb4c0653b64dc
SHA512 cd5ae0837236c849543d48e8734b34190f7ac872ee133618c41979b34ffd77d8e3aa208d692eca0640d97786efbd49032120ecdb59852257206e980e8babea1a
SSDEEP 49152:PHjKafwWzMQEIn34JAZtB9TzAob0sciC/v2A7ZuBvTzA4bKPnPQURoUT:fjK3FATBe3/v2A7ZuBvTzd2
TLSH
T14EC59E4AD6A901E8C576C17CC60B9617F77134480331EBEB57E04A661FE3BE1A7BA702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1822784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Kung\Downloads\timeless-rust_x_timeless-kernel\timeless-everything-build\timeless-rust.pdb

d3d9

Direct3DCreate9Ex

winmm

PlaySoundW

kernel32

GetTickCount MultiByteToWideChar GlobalAlloc GlobalFree OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared GetLocaleInfoEx FormatMessageA GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW GetProcAddress K32GetModuleInformation Sleep VirtualAlloc FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW VerifyVersionInfoW GetCurrentProcessId WaitForMultipleObjects GetCurrentProcess GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW SleepEx LoadLibraryW GetSystemDirectoryW LocalFree LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW GetModuleHandleW DeleteCriticalSection InitializeCriticalSectionEx CreateFileW VirtualFree CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask GetFileSizeEx FreeLibrary QueryPerformanceCounter SetLastError SetConsoleTitleA WriteFile TerminateProcess OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW CreateFileA Process32FirstW CloseHandle Module32FirstW Beep VirtualAllocEx GetConsoleWindow LoadLibraryExW VirtualQueryEx lstrcmpiW PeekNamedPipe Module32NextW

user32

ClientToScreen GetKeyboardLayout GetForegroundWindow DestroyWindow GetSystemMetrics ShowWindow SetWindowDisplayAffinity MessageBoxA ScreenToClient SetWindowPos SetLayeredWindowAttributes TranslateMessage SetWindowLongW PeekMessageA FindWindowA UpdateWindow SetForegroundWindow GetWindowLongA DispatchMessageA SetWindowLongA LoadCursorW SetCursor GetClientRect SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState GetKeyState

shell32

ShellExecuteA

ole32

CoInitialize CoUninitialize CoCreateInstance

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Mtx_unlock _Thrd_join _Thrd_detach ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Query_perf_counter _Thrd_id _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Random_device@std@@YAIXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Mtx_trylock ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

ws2_32

recvfrom sendto ioctlsocket gethostname getaddrinfo bind htonl closesocket listen WSAStartup inet_addr send accept socket WSACleanup getsockopt recv WSACloseEvent htons select WSACreateEvent __WSAFDIsSet WSAEnumNetworkEvents connect WSAEventSelect inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError WSAIoctl setsockopt getsockname freeaddrinfo getpeername

winhttp

WinHttpReadData WinHttpCrackUrl WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptBinaryToStringA

ntdll

RtlInitUnicodeString RtlCreateRegistryKey NtUnloadDriver NtQuerySystemInformation RtlWriteRegistryValue NtDeviceIoControlFile NtClose RtlGetFullPathName_UEx RtlAdjustPrivilege NtLoadDriver NtCreateFile

shlwapi

SHDeleteKeyW

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler _CxxThrowException wcschr __intrinsic_setjmp __current_exception_context __std_exception_destroy __std_exception_copy memcmp __std_terminate strstr memchr memset memmove strchr wcsstr strrchr longjmp memcpy

api-ms-win-crt-heap-l1-1-0

realloc calloc malloc _set_new_mode _callnewh free

api-ms-win-crt-stdio-l1-1-0

_close _fileno _write _read __p__commode _set_fmode _lseeki64 _wopen __acrt_iob_func feof fputs __stdio_common_vfprintf fgets fputc fflush fclose fgetc __stdio_common_vsscanf __stdio_common_vsprintf _wfopen fwrite fseek ftell __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetpos setvbuf

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s _gmtime64

api-ms-win-crt-string-l1-1-0

wcscat_s _stricmp wcscpy_s strlen _strdup wcsncpy strpbrk wcsncmp strspn wcspbrk strcspn _wcsicmp strncmp strcmp strncpy wcslen

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _unlink _lock_file _fstat64 _wstat64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoull strtoll strtod wcstombs strtoul atof

api-ms-win-crt-runtime-l1-1-0

__sys_errlist __sys_nerr _register_thread_local_exe_atexit_callback _c_exit _crt_atexit _invalid_parameter_noinfo_noreturn __p___argc abort _exit _errno _initterm_e terminate _initterm _beginthreadex _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit exit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv __p___argv

api-ms-win-crt-math-l1-1-0

sqrt log fmodf __setusermatherr _dsign atan2f sqrtf cosf acosf _fdopen logf pow atanf tanf ceilf powf cos asinf sinf sin

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

advapi32

CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 CryptDestroyKey CryptImportKey CryptEncrypt