rc7[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rc7.zip
Size 957KB
Sample260810-csc51attdw
SHA256 de0d09c6bb50a8fca9102abbefd7a3a0943a9f9b15da0235bf0f6a753cd6781d
MD5 68ba538990f968fae6efd9dd50ae29ed
SHA1 75683f0f2ca5b4aff9099d95091ddeeaff442e4f
SHA512 59ae66958c050019daa081c5ab63086f6ae3a1abf19112f7f4f74d0bcef86499aeb8b96629097e87694e2e7446f320b12f7ee2bb36269c9ad8a52545a87cecea
SSDEEP 24576:GNFPj78Rs4KH5Sx7Tzyw8OfDGuux5DSLZIMJ3FptwBESOvqMp:OL7sKIT+w8qDG5xM2M1twB2j
TLSH
T15125339A40A10BB5F222F5DE2DDEFE19DAB173C4BC82C148537F1B914F620E816636B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SciLexer.dll
unpack001/lua5.1.dll
unpack001/rc7.exe

File Explorer

rc7.zip

.zip 957KB
SciLexer.dll

.dll 937KB
lua5.1.dll

.dll 164KB
rc7.exe

.exe 1.3MB

rc7.zip

SHA256 de0d09c6bb50a8fca9102abbefd7a3a0943a9f9b15da0235bf0f6a753cd6781d
MD5 68ba538990f968fae6efd9dd50ae29ed
SHA1 75683f0f2ca5b4aff9099d95091ddeeaff442e4f
SHA512 59ae66958c050019daa081c5ab63086f6ae3a1abf19112f7f4f74d0bcef86499aeb8b96629097e87694e2e7446f320b12f7ee2bb36269c9ad8a52545a87cecea
SSDEEP 24576:GNFPj78Rs4KH5Sx7Tzyw8OfDGuux5DSLZIMJ3FptwBESOvqMp:OL7sKIT+w8qDG5xM2M1twB2j
TLSH
T15125339A40A10BB5F222F5DE2DDEFE19DAB173C4BC82C148537F1B914F620E816636B1
MD5 SHA1 SHA512 SSDEEP TLSH

SciLexer.dll

IMPHASH a92263e5625a22b5038bc250a01c009d
SHA256 bfe9704b80d6a08946097ffc72b8beb5f35d5e80ee41119186aaeba5d6c479e6
MD5 3f1c8e7ce6b40f9f2a970a9cd7b1b46b
SHA1 51afb6caefdfbed2454ebc072bc4977dce814be9
SHA512 7de215d18e624fd343980d0c14a028189e6c4ccd61c700abb1deec854b1b71e1ff635a79a0522c28d7dfacb4dcd63559cf2a801685795b0fe63942cbbabd0595
SSDEEP 24576:tzNuYNEXsnI8TIcid1+NgqAWTcDMmZcN8l+/4lBLONOFxOK:eYNcb8g1T00t3+OBLON2OK
TLSH
T13315C013B6CBC0B2DE2E3530553DB34E8A7DA9104831C59BF7E4A75D9E20291F9272A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

640563

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\u\arc\scintilla\bin\SciLexer.pdb

kernel32

FindFirstFileExA FindClose GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle GetACP GetModuleFileNameA GetModuleHandleExW ExitProcess HeapReAlloc HeapFree HeapAlloc LoadLibraryExW GetLastError InterlockedFlushSList RtlUnwind InitializeSListHead GetCurrentThreadId GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetLocaleInfoW CompareStringW GetCPInfo DecodePointer EncodePointer GetStringTypeW FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize WriteFile GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers EnterCriticalSection WriteConsoleW CloseHandle GlobalUnlock GetTickCount WideCharToMultiByte LCMapStringW GlobalLock GlobalFree GlobalAlloc GlobalSize Sleep GetLocaleInfoA GetModuleHandleA MulDiv QueryPerformanceCounter FreeLibrary DeleteCriticalSection GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar InitializeCriticalSection LeaveCriticalSection LoadLibraryExA RaiseException CreateFileW

user32

BeginPaint GetCursorPos ReleaseDC EndPaint ReleaseCapture RegisterClassExA GetParent GetUpdateRgn SetScrollInfo InvalidateRect HideCaret PostMessageA ScreenToClient NotifyWinEvent GetScrollInfo MsgWaitForMultipleObjects RegisterClassExW SetCaretPos OpenClipboard SetTimer GetDlgCtrlID CloseClipboard EmptyClipboard IsChild CreateCaret GetKeyboardLayout GetMessageTime SetFocus GetClipboardData DestroyCaret SetClipboardData AppendMenuA IsClipboardFormatAvailable GetCaretBlinkTime ShowCaret KillTimer PtInRect RegisterClipboardFormatA AdjustWindowRectEx GetKeyState GetWindowRect LoadCursorA DestroyWindow InflateRect GetDC SetWindowPos FillRect GetIconInfo GetSystemMetrics CreatePopupMenu DestroyCursor TrackPopupMenu ShowWindow DrawTextA SetWindowLongA CreateIconIndirect ClientToScreen CallWindowProcA MapWindowPoints GetWindowLongA GetDoubleClickTime FrameRect DrawFocusRect GetSysColor DefWindowProcA DestroyMenu CreateWindowExA SendMessageA SetCapture SetCursor SystemParametersInfoA GetClientRect DrawTextW UnregisterClassA

gdi32

LineTo GetObjectA ExtTextOutW RoundRect SetTextAlign CreateFontIndirectW GetTextMetricsA CreateRectRgn CreateBitmap CombineRgn GetNearestColor BitBlt CreateCompatibleBitmap ExtTextOutA SelectObject CreateDIBSection GetTextExtentPoint32A CreateCompatibleDC GetTextExtentExPointW StretchBlt GetStockObject GetTextExtentExPointA GetDeviceCaps CreatePatternBrush DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode CreatePen Rectangle GetObjectW Polygon MoveToEx SetBkColor Ellipse DeleteObject CreateSolidBrush IntersectClipRect

imm32

ImmSetCompositionStringW ImmEscapeW ImmGetCompositionStringW ImmSetCompositionWindow ImmSetCandidateWindow ImmNotifyIME ImmReleaseContext ImmGetContext ImmSetCompositionFontW

ole32

RevokeDragDrop RegisterDragDrop OleInitialize DoDragDrop OleUninitialize CLSIDFromProgID CoCreateInstance

oleaut32

SysFreeString SysAllocString

lua5.1.dll

IMPHASH df5ee731556844566bd09eb9e0c19cfb
SHA256 26384c6ee7d50863e3fb65fdc1bad452d9311f34d782390401de9bb130eecc4a
MD5 ee3043c17751c763e26d03f6eebb1b8b
SHA1 91d52c619c561db7f678b43456a2bd500064bfb1
SHA512 1ee1aefef0ace1d5fe4a5fac06d1e46e55c9a2180b98cbda540cdf4a15e5e6f17c99c473276524b10485be574032a66c34ce08a9c973e9a46c59249307dead41
SSDEEP 3072:PUvMMlibAYKY4rg4ODk2nCZdNcbjNXMga9j6n9aWBn:MvflibAYK/rFdwNcFI9aW
TLSH
T172F39D11FB93D178F88722FA4AFC607B0C35B199A7A6D0C76BD56C9248805F17A7930B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FreeLibrary FormatMessageA GetLastError GetProcAddress LoadLibraryA GetModuleFileNameA GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime

msvcr80

strtoul strcoll strerror ungetc strstr __iob_func _errno fopen fread fprintf ferror freopen realloc fclose getc feof free fputs fgets setvbuf fwrite ftell fseek clearerr fscanf tmpfile _pclose fflush _popen ceil modf ldexp rand srand strcspn _HUGE _mktime64 _gmtime64 tmpnam system remove clock strftime setlocale _localtime64 getenv _difftime64 _time64 rename memchr ispunct tolower isupper toupper islower strpbrk isxdigit strrchr _encode_pointer _malloc_crt _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common strncpy strncat sprintf strtod localeconv isspace iscntrl isdigit isalpha isalnum exit longjmp strchr frexp _setjmp3 _CIpow floor memcpy _CIexp _CIlog10 _CIlog _CIsqrt _CIfmod _CIatan2 _CIatan _CIacos _CIasin _CItanh _CItan _CIcosh _CIcos _CIsinh _CIsin

luaD_growstack luaF_newproto luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_error luaL_findtable luaL_getmetafield luaL_gsub luaL_loadbuffer luaL_loadfile luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffer luaL_pushresult luaL_ref luaL_register luaL_typerror luaL_unref luaL_where luaM_realloc_ luaM_toobig luaS_newlstr luaU_dump lua_atpanic lua_call lua_checkstack lua_close lua_concat lua_cpcall lua_createtable lua_dump lua_equal lua_error lua_gc lua_getallocf lua_getfenv lua_getfield lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_lessthan lua_load lua_newstate lua_newthread lua_newuserdata lua_next lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawset lua_rawseti lua_remove lua_replace lua_resume lua_setallocf lua_setfenv lua_setfield lua_sethook lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_status lua_toboolean lua_tocfunction lua_tointeger lua_tolstring lua_tonumber lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_xmove lua_yield luaopen_base luaopen_debug luaopen_io luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table

rc7.exe

IMPHASH a26b26aac5943f032cfa8ebe84d79a5e
SHA256 b294fb0872c6b921239027ffd88b804a7a2239f5bb2c77f3af9c2177456fddcc
MD5 a522edac6a0f62abdb7eab22cc264830
SHA1 92be89cdd6b82d6f4d97274bde1fd3c4ee026d65
SHA512 27b0ae28330ecec365ac31f6a2e0967a13716dcad029318a89ea4ca43c081349c4d8ce98585bd96bd08f10fae536d23746067d82df9acce7d2e5aebbcde668c0
SSDEEP 12288:Nk5NHUUzXbu37wHYsR2k1u+kfXrd5CImFg/PPPzhsn9LRbRa/bAM/:NCeUzLurwHVulvrHCaPPPzOrRazAM/
TLSH
T1235529207146A432C58AFAFF6A55E768513B2D9ADF078F9794F0321A087E0D3DE2D94C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

423043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

TextOutA GetObjectA SetTextColor SelectObject DeleteDC CreatePatternBrush CreateCompatibleDC BitBlt DeleteObject SetBkMode CreateSolidBrush CreateFontA

user32

SendMessageA DefWindowProcA PostQuitMessage DispatchMessageA RegisterClassExA CreateWindowExA DestroyWindow ShowWindow SetWindowPos SendDlgItemMessageA TranslateMessage GetMessageA UnregisterClassA GetFocus GetAsyncKeyState SetForegroundWindow GetWindowRect LoadCursorA LoadImageA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetWindowTextA LoadBitmapA GetParent GetDesktopWindow MapWindowPoints ScreenToClient GetCursorPos GetClientRect GetWindowTextA InvalidateRect GetForegroundWindow TrackPopupMenu AppendMenuA CheckMenuItem DestroyMenu CreatePopupMenu CreateMenu SetMenu MessageBoxA

kernel32

WaitForSingleObjectEx DecodePointer EncodePointer HeapReAlloc HeapSize SetEndOfFile ReadConsoleW WriteConsoleW CreateFileW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW SetStdHandle GetProcessHeap GetCPInfo GetOEMCP IsValidCodePage DeleteFileW GetTimeZoneInformation SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile CloseHandle GetModuleHandleA CreateDirectoryA CreateFileA GlobalAlloc GlobalLock CreateEventW Sleep FindClose GetModuleFileNameA FindFirstFileA AllocConsole GetProcAddress VirtualAllocEx VirtualFreeEx VirtualQueryEx OpenProcess TerminateProcess RaiseException CreateThread CreateRemoteThread GetLastError ReadProcessMemory WriteProcessMemory InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject CreateToolhelp32Snapshot Process32First Process32Next ExitProcess SetUnhandledExceptionFilter LoadLibraryA GetCurrentProcess SetFilePointer ReadFile SetEvent ResetEvent InitializeSListHead QueryPerformanceCounter GetCurrentProcessId RtlUnwind InterlockedPushEntrySList FindFirstFileExA FlushFileBuffers GetFileAttributesExW CreateProcessA GetExitCodeProcess GetStringTypeW MoveFileExW GetCommandLineW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW FindNextFileA GetCommandLineA GlobalUnlock GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStartupInfoW GetFileType GetStdHandle HeapAlloc HeapFree GetACP GetCurrentThreadId SetLastError IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent DeleteCriticalSection MultiByteToWideChar FreeLibrary GetModuleHandleW GetModuleHandleExW WideCharToMultiByte

comctl32

ord413 ord410 InitCommonControlsEx

advapi32

RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey RegDeleteValueA

ws2_32

htons inet_addr recv send connect WSAStartup WSACleanup WSAGetLastError shutdown closesocket socket

psapi

GetModuleFileNameExA EnumProcesses

winmm

PlaySoundA

comdlg32

GetOpenFileNameA GetSaveFileNameA ChooseColorA

lua5.1

lua_tolstring lua_pushstring lua_getfield lua_setfield lua_pcall lua_gc luaL_openlibs luaL_loadstring luaL_newstate lua_close

shell32

ShellExecuteA

shlwapi

PathFindFileNameA

Name

.text

Size

463KB

Virtual Size

462KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

713KB

Virtual Size

713KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

rc7.zip

SciLexer.dll

kernel32

user32

gdi32

imm32

ole32

oleaut32

generic

lua5.1.dll

kernel32

msvcr80

generic

rc7.exe

gdi32

user32

kernel32

comctl32

advapi32

ws2_32

psapi

winmm

comdlg32

lua5.1

shell32

shlwapi

generic