Rift[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Rift.exe
Size 5.6MB
Sample260929-sqqlbatdkh
SHA256 68f95348d27867267e99d41246e7b5b1180bbf3afc5d7a1bd48ced820de8101b
MD5 cbecc30416d442a0e5a764aece551aaa
SHA1 24cdc9b23654de055ef984306067ee4ef229db3e
SHA512 709e867389e2c532edde94362af3f532fd9dcb31d89bd4be1e52c3341e86ddadf52efe6bff13b5921643e6a46b40d029559ed07fb0126ed1b2281a4971bd26bf
SSDEEP 49152:2XuPeiu9ryjkRDG7iD2dqEg0tbLYJeMeXEX9+wqThBFT6r0Mw/FvgLdkp8hLGPQf:Muu1ywRDIBdaS1TNnvgLdVhSP5NSj
TLSH
T1D3469D61A5AC469CE07AF038C693A617E3F17C0D1321DFCB96D09D670E2F5D0B6BA609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Rift.exe

File Explorer

Rift.exe

.exe 5.6MB

Rift.exe

IMPHASH 7ea6ac3a9ce83df5b3cb7733aa93e8f2
SHA256 68f95348d27867267e99d41246e7b5b1180bbf3afc5d7a1bd48ced820de8101b
MD5 cbecc30416d442a0e5a764aece551aaa
SHA1 24cdc9b23654de055ef984306067ee4ef229db3e
SHA512 709e867389e2c532edde94362af3f532fd9dcb31d89bd4be1e52c3341e86ddadf52efe6bff13b5921643e6a46b40d029559ed07fb0126ed1b2281a4971bd26bf
SSDEEP 49152:2XuPeiu9ryjkRDG7iD2dqEg0tbLYJeMeXEX9+wqThBFT6r0Mw/FvgLdkp8hLGPQf:Muu1ywRDIBdaS1TNnvgLdVhSP5NSj
TLSH
T1D3469D61A5AC469CE07AF038C693A617E3F17C0D1321DFCB96D09D670E2F5D0B6BA609
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4826544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\adami\Desktop\Rift External\native-client\bin\Rift.pdb

winhttp

WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

crypt32

CryptProtectData CryptUnprotectData

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptHashData BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyKey BCryptGetProperty BCryptCreateHash BCryptOpenAlgorithmProvider BCryptSetProperty

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

shell32

ShellExecuteA SHGetFolderPathW ShellExecuteW

kernel32

GetSystemTimeAsFileTime WakeAllConditionVariable GetFileInformationByHandleEx SetUnhandledExceptionFilter AreFileApisANSI CreateFile2 InitializeSListHead GetLocaleInfoEx SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentThreadId SleepConditionVariableSRW GetModuleHandleA CreateDirectoryW SizeofResource GetFullPathNameW TerminateProcess GetEnvironmentVariableW FindResourceA WaitForSingleObject ResumeThread OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep Process32NextW LockResource DeleteFileW Process32FirstW CloseHandle AcquireSRWLockExclusive CreateProcessW GetModuleHandleW WideCharToMultiByte QueryFullProcessImageNameW MoveFileW GetComputerNameA ReadFile WriteFile GetModuleFileNameW GetTempPathW CreateFileW GetCurrentProcessId GetProcAddress GetLocalTime FindFirstFileW FindNextFileW FindClose GetModuleFileNameA GetFileAttributesA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter Process32First Process32Next ReadProcessMemory GetVolumeInformationA GetSystemInfo LocalFree WriteProcessMemory Module32Next GetProcessId Module32First K32GetProcessMemoryInfo VirtualAllocEx GetTickCount64 QueryFullProcessImageNameA SetThreadPriority GetCurrentThread GetTickCount SetHandleInformation GetStdHandle CreatePipe GetFileAttributesW GetTempFileNameW GetExitCodeProcess LoadLibraryExA GetLastError FormatMessageA CreateFileA GetFileSizeEx HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA LoadResource ReleaseSRWLockExclusive

user32

IsWindowVisible IsWindow FindWindowA GetKeyState GetMessageExtraInfo LoadCursorA GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard GetClipboardData SetClipboardData GetKeyNameTextA MapVirtualKeyA SendInput ClipCursor DefWindowProcW WindowFromPoint IsChild PostQuitMessage GetClientRect ScreenToClient GetAsyncKeyState SetWindowDisplayAffinity GetCursorPos GetWindowLongW GetWindowThreadProcessId SetWindowPos EnumWindows SetWindowLongW DispatchMessageA DestroyWindow SetWindowLongPtrW EmptyClipboard GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow MessageBoxA SetLayeredWindowAttributes TranslateMessage PeekMessageA UpdateWindow GetWindow CreateWindowExW

advapi32

GetUserNameA

msvcp140

?_Xinvalid_argument@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Winerror_map@std@@YAHH@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xbad_function_call@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ _Cnd_signal ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z _Thrd_id _Thrd_join _Cnd_broadcast ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

winmm

timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception memcmp memchr __std_exception_destroy __std_exception_copy __std_terminate wcsrchr strstr strchr __C_specific_handler strrchr longjmp memcpy memmove memset

api-ms-win-crt-heap-l1-1-0

free realloc malloc _set_new_mode _callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fgets __stdio_common_vfprintf _wfopen_s __stdio_common_vsprintf feof fopen_s fseek _set_fmode fwrite tmpnam ferror ftell fgetpos setvbuf ungetc __p__commode __stdio_common_vsprintf_s _ftelli64 _popen tmpfile _pclose clearerr __stdio_common_vswprintf_s getc _wfopen fsetpos _fseeki64 fopen freopen fread __acrt_iob_func _get_stream_buffer_pointers fputc fflush fgetc fclose

api-ms-win-crt-string-l1-1-0

_wcsicmp isdigit isspace isalnum isxdigit isalpha strspn strpbrk _strnicmp _stricmp wcslen toupper strcpy strlen isgraph isupper iscntrl ispunct islower tolower strcoll strncpy strcmp strncpy_s strncmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function exit _crt_atexit strerror _register_thread_local_exe_atexit_callback _c_exit _cexit system __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _beginthreadex _errno terminate _set_app_type _seh_filter_exe abort

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _unlock_file rename

api-ms-win-crt-convert-l1-1-0

atof strtol strtoull strtod strtoll atoi _atoi64

api-ms-win-crt-time-l1-1-0

_time64 _difftime64 _localtime64_s clock _mktime64 strftime _gmtime64 _localtime64

api-ms-win-crt-math-l1-1-0

ceil ceilf atan2f frexp atan2 asinf asin acosf cos acos cosf exp roundf fminf expf floor floorf fmod ldexp lroundf tan lround fmodf log log10 sqrtf sqrt __setusermatherr sinf sin logf powf pow

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-locale-l1-1-0

setlocale ___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-environment-l1-1-0

getenv