Risxn Pro.zip
- SHA256 681ba43623a4e2e0073c4c6a4bcf13332e2e7c19fe0eb81a35b0d2a6ec98e3b3
Behavioral task
behavioral1
Sample
Risxn Pro.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Risxn Pro.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
pro/Risxn Pro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
pro/Risxn Pro.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Risxn Pro.zip
- Size 1.3MB
- Sample260809-a44e8a1wew
- SHA256 681ba43623a4e2e0073c4c6a4bcf13332e2e7c19fe0eb81a35b0d2a6ec98e3b3
- MD5 f25f2540860a4095d14cc57c53531e89
- SHA1 a9e638f0a4e9ad74b179433504782328809a3ef8
- SHA512 c195197c1022e0e2f2a385c717963953af679a75511a1295d5e805185d483c61b4a0bcc57ba7691f60e32e7fdd73a4c74a2459a8c1b59a9d6d61990da614507e
- SSDEEP 24576:sQPczqe7y5pz30/4/hY3WDRxZgfQgy1riby8yfulwqR13F9kF/WfhD/sp+:ZO7W51E/4/hGWljF0JsqRlDJDkp+
- TLSH T1AD55334CDD129D4067627DF90A2B8A37C43E9D63545BE0B91C2AB64DBB787A91C3F00E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/pro/Risxn Bug Fixer.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/pro/Risxn Bug Fixer.exe unpack001/pro/Risxn Pro.exe
File Explorer
-
Risxn Pro.zip.zip 1.3MB
-
pro/I NEED HELP SETTING UP.txt115B
-
pro/Risxn Bug Fixer.exe.exe 16KB
-
pro/Risxn Pro.exe.exe 2.2MB
-
pro/dependencies.txt192B
-
pro/tutorial.txt28B
pro/I NEED HELP SETTING UP.txt
- SHA256 f48de9fbe7e94fda4338307b9d54a6364ae55125b3e79632336f2bfbf9a52977
- MD5 0d10324b15d8caf299c3bcb8e32af481
- SHA1 14c3d34853de6daa4459bf7688e5742e1655e59e
- SHA512 232c00e1f94576f80fbc16ed5459c36e78ebc017093e82ddc670628e77a55c7d9c0f4ef1b280a58c530d01a2b13002ec97d2894440991e459e3726f4aae4782d
- TLSH T108B0924F9B210A68962217984AC57004FF60928C0888904ED83AA60C401959A3CEE5D9
- MD5 SHA1 SHA512 TLSH
pro/Risxn Bug Fixer.exe
- SHA256 25499370f9f64ed12d21f15d203ab689e688bf5121537e85876c366444df6099
- MD5 d7c81fa55acb5b2cf88193e1cc677d95
- SHA1 8fa1fddb17fa614d64c069d0790ac7c2cdc34fd5
- SHA512 5b27109866b458b7a25cb0071e0f1cd2d847867d4d8310bb1e3e402c87e48a1d1aa08674eb0ae6708302e1e3acddf976d9f3f9b72155606df11d36efef37622a
- SSDEEP 384:ASaCCJwYQZZSz03N4e6Zon5H7aNJawcudoD7USFG:AS1VZ6i4egnbcuyD7U
- TLSH T1CC725C83A2069E84C439027B0AAFF67A4724FE8CE555D7535EDA3C377C73B922C54642
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
60864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
pro/Risxn Pro.exe
- IMPHASH 3a01d70869465fd75e719b5bfdbb6afd
- SHA256 f0c607c8d473fbe1c313d605843654ec8988e81126e05ef9c503cd7c5b85090e
- MD5 68efd7a373c0e7efe0dbd844cd27da9d
- SHA1 f09ccd8874116b128b92a6646e4858ab7c8467b6
- SHA512 f535634e377d2aa086de28a5039fa3e9d89b80df9348d863b55d1156115f51d5c0d628d0b426a008b60ee16cb03b9c529aad6553def587fb9b2c403011bfd9a0
- SSDEEP 49152:oeevq5vKRKT4LzYaTzKET+QoPC0u3dtT8eABI:SRKwB6QoXdF
- TLSH T198B5D09149987CBCF99E9FF420206D3D188DAD6470BC6514C698E34E878B98CB72F49F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Pick\AppData\Local\Temp\NqocOocQObc\x64\Release\TemplateRobust.pdb
kernel32
SizeofResource
GetCurrentProcess
TerminateProcess
GetProcessId
K32GetProcessImageFileNameA
FindResourceA
ResumeThread
DuplicateHandle
OpenProcess
GetExitCodeThread
Sleep
GetTempPathA
LoadLibraryA
LockResource
CloseHandle
LoadResource
GetProcAddress
ExitProcess
GetCurrentProcessId
GetModuleHandleW
GetConsoleWindow
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext
user32
ShowWindow
ole32
CoInitializeEx
msvcp140
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Xlength_error@std@@YAXPEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__C_specific_handler
__std_terminate
memset
__std_exception_destroy
memchr
memcpy
__current_exception
__current_exception_context
__std_exception_copy
memmove
api-ms-win-crt-stdio-l1-1-0
fread
ungetc
setvbuf
fgetpos
fwrite
__p__commode
_set_fmode
fgetc
fclose
fflush
fputc
_get_stream_buffer_pointers
_fseeki64
fsetpos
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_exit
_initialize_narrow_environment
__p___argc
_configure_narrow_argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_set_app_type
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe
terminate
_initterm
_invalid_parameter_noinfo_noreturn
_get_initial_narrow_environment
__p___argv
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
_callnewh
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=33218,
count=3, id=259, version=33218,
count=26, id=261, version=33218,
count=6, id=257, version=33218,
count=7, id=257, version=29395,
count=133, id=1, productName=Unmarked objects,
count=1, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
pro/dependencies.txt
- SHA256 28ac9158efb9e1a3c20d28c8402f8822398851c4d598398eef36f223b4645b00
- MD5 9a8f91bc43cccf15c91066aad26e83bf
- SHA1 2e253e4b7c752ce8d6aec75707d1e15962296598
- SHA512 2ba4b934a7bd118895e1e034ae6748932f66f088e2988c04e766827fd07e4f891d3253adeed32c8bfda69a722b9de9669e1893e6912fc990af6dcee703c7108d
- TLSH T146C0229BC31881531E9082864202A004E2070B0AB6C5C0ECA0C0C554A12F4F6A01228B
- MD5 SHA1 SHA512 TLSH
pro/tutorial.txt
- SHA256 fc60bc3717f4afdfd2ed8db562c1e958ec1da21f61432d21ea8040548c813890
- MD5 a233aaaeea205011f4193059b85753fe
- SHA1 5178dfa4c48d28eb4d15eb260ba5279d747cc095
- SHA512 c11cd74be8f83626bfde40e2356cdd6f67e7f71b53bddd890727384fcf70932aaffc469b96f257025dc7810cd909add033c9f5739e31f11b5441a4d4543b6ac5
- MD5 SHA1 SHA512