R6[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
R6.exe
Size 2.8MB
Sample260907-ahn4easzhs
SHA256 e01f8707b62d2dba8f777b69ef124eb5d5851710d080ef28d19822c2e8b0fc44
MD5 0dde184dc182d88f0719aac0a3e29a04
SHA1 3387fe4bc54e98bb8f694ffa4c68c35f9e4d03b7
SHA512 80588dca9825840bacfdfa98bde64871f6cdda06c001cb02b7baf498b20efb9d31594af5e054ce50a53802cfde55e157883382b280cc2290147e0a30a170cd04
SSDEEP 49152:qqgfR0EXXEzjMbW5r/FVPJvzAngaplsDZGkIhjYuLusH+5S:qqIVb+rAplEPIhjw2
TLSH
T186D5CF03B3A542ECD0779538C662D71AE372B8460720E6CF27A01A699F636F05F7B761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
R6.exe

File Explorer

R6.exe

.exe 2.8MB

R6.exe

IMPHASH ff1ee4877cb178f82e5f21a706ecb21d
SHA256 e01f8707b62d2dba8f777b69ef124eb5d5851710d080ef28d19822c2e8b0fc44
MD5 0dde184dc182d88f0719aac0a3e29a04
SHA1 3387fe4bc54e98bb8f694ffa4c68c35f9e4d03b7
SHA512 80588dca9825840bacfdfa98bde64871f6cdda06c001cb02b7baf498b20efb9d31594af5e054ce50a53802cfde55e157883382b280cc2290147e0a30a170cd04
SSDEEP 49152:qqgfR0EXXEzjMbW5r/FVPJvzAngaplsDZGkIhjYuLusH+5S:qqIVb+rAplEPIhjw2
TLSH
T186D5CF03B3A542ECD0779538C662D71AE372B8460720E6CF27A01A699F636F05F7B761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1129344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileW

comdlg32

GetOpenFileNameW

shell32

Shell_NotifyIconW ShellExecuteW

gdi32

DeleteObject SelectObject CreateCompatibleDC DeleteDC SetStretchBltMode StretchBlt CreateDIBSection

user32

LoadIconW FindWindowW MessageBeep MessageBoxW SetForegroundWindow UpdateWindow SystemParametersInfoW TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu SendInput ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage RegisterWindowMessageW GetClipboardData MonitorFromWindow LoadCursorW ScreenToClient ClientToScreen MonitorFromPoint SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode SetProcessDpiAwarenessContext SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EnumDisplayMonitors GetMonitorInfoW GetWindow GetWindowThreadProcessId EnumWindows GetWindowRect GetClientRect ReleaseDC GetDC GetAsyncKeyState EmptyClipboard SetClipboardData CloseClipboard OpenClipboard IsIconic IsWindowVisible SetWindowPos SetLayeredWindowAttributes IsWindow PostMessageW GetCursorPos ReleaseCapture

kernel32

GetOEMCP FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetEnvironmentVariableW LoadLibraryExW VirtualProtect OutputDebugStringW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineA TerminateProcess ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetACP SetStdHandle HeapSize CreateToolhelp32Snapshot GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable GetLocalTime ExpandEnvironmentStringsW CreateDirectoryW CreateFileW DeleteFileW GetDriveTypeW GetFileAttributesW GetFileSize ReadFile WriteFile CloseHandle WaitForSingleObject GetProcessTimes GetCurrentProcess GetExitCodeProcess CreateProcessW OpenProcess GetSystemInfo GetTickCount64 GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryFullProcessImageNameW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte SetEndOfFile Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA GetCommandLineW SetUnhandledExceptionFilter GetLastError ReleaseMutex CreateMutexW Sleep GetCurrentProcessId GetModuleHandleW CreateFileA GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

403KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

959KB

Virtual Size

973KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

R6.exe

d3d11

d3dcompiler_43

d3dx11_43

comdlg32

shell32

gdi32

user32

kernel32

imm32

generic