rainbowscheat[.]exe

General

Target
rainbowscheat.exe
Size 76KB
Sample260828-1c1hcstdnc
SHA256 f7dd7904f0aa943ea273dc91e91840a8c27fcccb699fee98801460c17817be5a
MD5 a2ff7fc5a6027b5437be56fcb3ba418f
SHA1 85f3d2ec1d5b22958ca89651216cf7100a2a722f
SHA512 96f9a13b215ecb54b3759279d28a0b26217987ae5d1ef7a72d77c4afa28d336f83fc526195b8bcf57cab92942a9e30fc3812705e53c7b12a3cee14fca3a80562
SSDEEP 1536:LHow1xvh8hUelTfjfutQ40Dv4yaLJ5inhzxDhjLYJAIsWk6cdG2357Rh:L+h9lTfj7lDv4/Pintxlo2Goxj
TLSH
T14B734B03B5D1C471E4B21E351870C9A15A2EF9214F65DE6B2788133E4F381D2AE3AE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rainbowscheat.exe

File Explorer

rainbowscheat.exe

.exe 76KB

rainbowscheat.exe

IMPHASH 85fa1160bc48643a647d7e5509a0e32e
SHA256 f7dd7904f0aa943ea273dc91e91840a8c27fcccb699fee98801460c17817be5a
MD5 a2ff7fc5a6027b5437be56fcb3ba418f
SHA1 85f3d2ec1d5b22958ca89651216cf7100a2a722f
SHA512 96f9a13b215ecb54b3759279d28a0b26217987ae5d1ef7a72d77c4afa28d336f83fc526195b8bcf57cab92942a9e30fc3812705e53c7b12a3cee14fca3a80562
SSDEEP 1536:LHow1xvh8hUelTfjfutQ40Dv4yaLJ5inhzxDhjLYJAIsWk6cdG2357Rh:L+h9lTfj7lDv4/Pintxlo2Goxj
TLSH
T14B734B03B5D1C471E4B21E351870C9A15A2EF9214F65DE6B2788133E4F381D2AE3AE7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5556

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ACER\source\repos\salinewin\Release\salinewin.pdb

kernel32

GetProcAddress ExitProcess CreateFileW DecodePointer CreateThread WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc LoadLibraryW CloseHandle TerminateThread Sleep HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CompareStringW LCMapStringW RaiseException

user32

ReleaseDC InvalidateRect GetDesktopWindow GetSystemMetrics EnumChildWindows SendMessageTimeoutW GetDC MessageBoxW

gdi32

SelectObject CreateDIBSection CreateCompatibleDC DeleteDC BitBlt

winmm

waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite waveOutPrepareHeader

Sharing