RbxDumper[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RbxDumper.exe
Size 372KB
Sample260815-ffv2tsdh56
SHA256 04fbee15f472b4f135a423a67ef4e36cfe5ff75370d87d990cfdb66441ab1082
MD5 935f66bd8527c5d90d53875b006b02f2
SHA1 756861881499a130ed2e35ac90fb2f3239a8da9c
SHA512 711b19d2fe69110759aef7e4496305a353d354ae7e80901d31419d45aefb8bd11d9f9f4753b35cd627cd745b7e3d5ca92f4b2f71f1d921be90278092707ebedf
SSDEEP 6144:V84KhiFE4q4HJecnVZnFFa6VtMOznrOUj8mpmxmlm/0k3yd696J7oNvIS3h7yCff:hPpHJecnVZnFFa6VtMOznrOUj8mpmxmi
TLSH
T15484C919ED351978D1EEC0B8DF5A5922F63678C9037295FB2FC097F19E05060AA36F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RbxDumper.exe

File Explorer

RbxDumper.exe

.exe 372KB

RbxDumper.exe

IMPHASH 5475739559286e2f9b3482bf1a14533c
SHA256 04fbee15f472b4f135a423a67ef4e36cfe5ff75370d87d990cfdb66441ab1082
MD5 935f66bd8527c5d90d53875b006b02f2
SHA1 756861881499a130ed2e35ac90fb2f3239a8da9c
SHA512 711b19d2fe69110759aef7e4496305a353d354ae7e80901d31419d45aefb8bd11d9f9f4753b35cd627cd745b7e3d5ca92f4b2f71f1d921be90278092707ebedf
SSDEEP 6144:V84KhiFE4q4HJecnVZnFFa6VtMOznrOUj8mpmxmlm/0k3yd696J7oNvIS3h7yCff:hPpHJecnVZnFFa6VtMOznrOUj8mpmxmi
TLSH
T15484C919ED351978D1EEC0B8DF5A5922F63678C9037295FB2FC097F19E05060AA36F22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

292516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Moon\source\repos\RbxDumper\x64\Release\RbxDumper.pdb

kernel32

OpenProcess CreateToolhelp32Snapshot Sleep CloseHandle Module32FirstW QueryFullProcessImageNameW VirtualQueryEx Thread32Next Thread32First SuspendThread ResumeThread VirtualProtectEx OpenThread AcquireSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter ReleaseSRWLockExclusive

user32

GetAsyncKeyState FindWindowA SetForegroundWindow SendInput GetWindowThreadProcessId

msvcp140

?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

ntdll

NtReadVirtualMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler _CxxThrowException __current_exception __std_exception_copy __std_exception_destroy memset memmove memcpy memcmp __std_terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fputc __p__commode fflush __stdio_common_vfprintf _set_fmode fclose _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fgetc fwrite

api-ms-win-crt-runtime-l1-1-0

_errno terminate _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initterm _initterm_e exit _exit _c_exit __p___argc __p___argv

api-ms-win-crt-string-l1-1-0

strlen tolower isdigit isalnum wcslen

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtoull strtol strtoul

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale