r13hrtv_patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
r13hrtv_patched.exe
Size 1.1MB
Sample261002-yejxaagf73
SHA256 45c8487a6dadf8c97559b8d538265b7de3e32ec9cdb7f39a93a7014d84692258
MD5 f3ed6601d896e9bbf0c923ac803ce9b9
SHA1 77e34a216a038e5246b7c6f0439eab1cc1dfc4fa
SHA512 e4a6f38eda824bdc61b6a6047142837133a934ccd48196a9a5c880404d51c8135bbcff2ff5349d3c56153601de95e991292fa510d77231042a713ba33647f539
SSDEEP 24576:LPvLKAijfgP8qr/zLGAR91ifChkW1pzuQAjvlIXJ:ftL0SOARbifskW1hO
TLSH
T1D2456C39DA94A198CD99E03AE1CB423D936B613C73119BF78015CA833D56FEF2176326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
r13hrtv_patched.exe

File Explorer

r13hrtv_patched.exe

.exe 1.1MB

r13hrtv_patched.exe

IMPHASH fa8c79d7343bf31d21b420e2c40f187c
SHA256 45c8487a6dadf8c97559b8d538265b7de3e32ec9cdb7f39a93a7014d84692258
MD5 f3ed6601d896e9bbf0c923ac803ce9b9
SHA1 77e34a216a038e5246b7c6f0439eab1cc1dfc4fa
SHA512 e4a6f38eda824bdc61b6a6047142837133a934ccd48196a9a5c880404d51c8135bbcff2ff5349d3c56153601de95e991292fa510d77231042a713ba33647f539
SSDEEP 24576:LPvLKAijfgP8qr/zLGAR91ifChkW1pzuQAjvlIXJ:ftL0SOARbifskW1hO
TLSH
T1D2456C39DA94A198CD99E03AE1CB423D936B613C73119BF78015CA833D56FEF2176326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\src\Carlos\svc-Notability\out\ninja\x64-uwp\Ubsan\Notability.ipdb

ws2_32

inet_ntoa inet_ntop WSACleanup getaddrinfo socket socket ioctlsocket closesocket inet_pton htons WSAStartup gethostname recv WSACleanup connect send listen bind getsockopt accept WSAGetLastError WSAGetLastError select closesocket send WSAStartup

user32

MessageBoxW ShowWindow IsWindow GetKeyState DefWindowProcA GetClientRect SetWindowPos IsWindowVisible TranslateMessage FindWindowA UnregisterClassW GetAsyncKeyState SetClipboardData GetWindowTextLengthW

shell32

ShellExecuteExA

advapi32

GetTokenInformation OpenProcessToken OpenServiceA CryptEncrypt RegCloseKey LookupPrivilegeValueA OpenSCManagerW GetNamedSecurityInfoA RegOpenKeyExW OpenServiceW CryptDestroyHash CryptGenRandom RegDeleteValueW RegSetValueExW CryptAcquireContextA RegQueryInfoKeyA CryptDecrypt CryptAcquireContextW

ucrtbase

strcat _fseeki64 wcscat_s memmove strlen strstr rand strtol _set_errno strncpy_s strcat_s memcpy

ntdll

NtOpenFile NtOpenProcess RtlEqualUnicodeString RtlFreeHeap RtlAllocateHeap NtReadVirtualMemory NtProtectVirtualMemory RtlNtStatusToDosError NtWriteVirtualMemory LdrGetDllHandle RtlFreeUnicodeString NtQueryVirtualMemory RtlCaptureStackBackTrace RtlMoveMemory NtSuspendThread NtQuerySystemInformation NtOpenThread RtlCopyMemory

msvcrt

atof _wcsicmp fflush _snprintf free calloc malloc _stricmp fclose fwrite _vsnprintf sprintf ftell

bcrypt

BCryptCreateHash BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptImportKey BCryptCloseAlgorithmProvider BCryptSecretAgreement BCryptDeriveKey BCryptGenRandom BCryptExportKey BCryptHashData BCryptFinishHash

kernel32

GetModuleFileNameW GetConsoleOutputCP GetProcAddress CompareStringW RtlLookupFunctionEntry GetProcessTimes ReleaseMutex MultiByteToWideChar TlsGetValue FreeEnvironmentStringsW EnterCriticalSection WriteConsoleW LCMapStringW SetUnhandledExceptionFilter RtlUnwindEx GetStringTypeW HeapFree Sleep HeapAlloc GetFileAttributesA SetEnvironmentVariableW FlsFree GetModuleHandleExW UnhandledExceptionFilter ExitProcess IsDebuggerPresent WriteFile GetConsoleMode VirtualAlloc GetExitCodeProcess FlsSetValue GetEnvironmentStringsW TerminateProcess GetModuleHandleA TlsSetValue IsValidCodePage HeapReAlloc GetModuleHandleW FindClose GetFileType GetTickCount GetFileSizeEx ResumeThread TlsAlloc GetCommandLineA RtlVirtualUnwind WideCharToMultiByte HeapSize SetConsoleTextAttribute AllocConsole CreateFileW GetLastError LoadLibraryExW GetTempPathW GetProcessHeap ReadConsoleW InitializeCriticalSectionAndSpinCount CloseHandle CreateFileMappingW FindNextFileW CreateProcessW GetCurrentProcess SetEndOfFile GetSystemTimeAsFileTime FindFirstFileExW GetCurrentProcessId EncodePointer RaiseException LoadLibraryA RtlPcToFileHeader FlsAlloc InitializeSListHead GetCommandLineW FlsGetValue SetStdHandle GetFileAttributesExW InitializeCriticalSectionEx DeleteCriticalSection TlsFree WaitForSingleObject LeaveCriticalSection GetTempFileNameA FreeLibrary GetCPInfo ResetEvent FlushFileBuffers IsProcessorFeaturePresent VirtualProtect ReadFile VirtualFree GetVersion SetLastError Process32FirstW MapViewOfFile RtlCaptureContext CreateThread InterlockedFlushSList GetOEMCP GetACP CreateEventA GetModuleFileNameA CreateSemaphoreW SetFilePointerEx GetStdHandle DeleteFileA CreateDirectoryA VirtualProtectEx GetStartupInfoW