Release[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Release.rar
Size 705KB
Sample261009-sqlmcsat9x
SHA256 e876015d6b891a7882a008c1df6f2d8867cb17809d879606c104d602fd8c5679
MD5 45b40be181c227c05a1734170584620d
SHA1 945864a389661c959c9dd2dad34a1551d0ce0f70
SHA512 01723e6b0197ba3d886e53f18f26ece7ea0b4bf09b093d00f744efb1750f1c623ccc43cf20db2fd9ea460e37854f2687e69db9cbac51f691e35f482f3f1aa462
SSDEEP 12288:0RiYJzA8Tj/cEQTbwcbqQaunf+bAg3qSuE2FARgLg/pJS0YjjgibzaTYUFyQ:KiYJzvPQ/wmqQdnMWSVOLg/pYJjgiKsI
TLSH
T118E433E700D913667B15D3B3E3D8AEE492284F14A50ECB93D9E19E5BE033AC88472577
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Release/RetracCheat.exe
unpack001/Release/loader.dll

File Explorer

Release.rar

.rar 705KB
Release/RetracCheat.exe

.exe 1.3MB
Release/loader.dll

.dll 108KB

Release.rar

SHA256 e876015d6b891a7882a008c1df6f2d8867cb17809d879606c104d602fd8c5679
MD5 45b40be181c227c05a1734170584620d
SHA1 945864a389661c959c9dd2dad34a1551d0ce0f70
SHA512 01723e6b0197ba3d886e53f18f26ece7ea0b4bf09b093d00f744efb1750f1c623ccc43cf20db2fd9ea460e37854f2687e69db9cbac51f691e35f482f3f1aa462
SSDEEP 12288:0RiYJzA8Tj/cEQTbwcbqQaunf+bAg3qSuE2FARgLg/pJS0YjjgibzaTYUFyQ:KiYJzvPQ/wmqQdnMWSVOLg/pYJjgiKsI
TLSH
T118E433E700D913667B15D3B3E3D8AEE492284F14A50ECB93D9E19E5BE033AC88472577
MD5 SHA1 SHA512 SSDEEP TLSH

Release/RetracCheat.exe

IMPHASH f41acec08001e00dcc98891be8124398
SHA256 17260f5914844b7722957583a11d667b1e7d350326d174717d5e0545a2eaa858
MD5 4dff274149d9a98b86f7312d4438f4d6
SHA1 5097fe8902e377ace8b905fbace51cf7b5c57a12
SHA512 be0474d4853d8366a8df9c8a33a002727ab3d33219b47ebd43e445c9b06e8173862e186059b80d039f64a7bb0ede8cfeb2164f9ee687804f986a4798bbfb82b0
SSDEEP 24576:cUEwxLC6u9F0sKS7WJ9J2E3kjJebn8RZRZbVdul3BTk:cUvxL3OCvBJOAksnCRZI3
TLSH
T17155BF1EF9D950FCD136E478C566A91BEB31B819471059EB33E048A81F2A7D06FBB603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

587200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zyro\Desktop\coding\PulseRetrac\PulseRetrac\x64\Release\RetracCheat.pdb

dwmapi

DwmExtendFrameIntoClientArea

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf _wfopen _kbhit __stdio_common_vsprintf_s fgetc __acrt_iob_func _get_stream_buffer_pointers fwrite fclose fflush _fseeki64 __stdio_common_vsprintf fgetpos fputc _set_fmode ftell setvbuf ungetc __stdio_common_vsscanf fread __p__commode fsetpos fseek

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode realloc _callnewh free

api-ms-win-crt-string-l1-1-0

tolower strlen _stricmp strcmp toupper strcat_s strncpy_s towlower strcpy_s isalnum isxdigit strncmp _wcsicmp strncpy isalpha isspace

api-ms-win-crt-runtime-l1-1-0

system terminate _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _beginthreadex _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

tanf roundf acosf asinf atan2f ceilf cosf floorf fmodf __setusermatherr pow powf sinf sqrt sqrtf ldexp

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-convert-l1-1-0

strtoll strtol atof

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset wcsstr __C_specific_handler strchr strstr __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context __current_exception _CxxThrowException memcmp memmove memcpy memchr

kernel32

AcquireSRWLockExclusive GetModuleHandleW GetSystemTimeAsFileTime ReleaseSRWLockExclusive CheckRemoteDebuggerPresent IsDebuggerPresent OpenThread VirtualQuery SetDllDirectoryW GetTickCount SetThreadContext QueryFullProcessImageNameW GetCurrentProcessId ExitProcess LocalFree GetThreadContext AddVectoredExceptionHandler Module32FirstW K32GetModuleInformation GetCurrentThread GetTickCount64 GetSystemDirectoryW GetCurrentThreadId Thread32Next InitializeSListHead SleepConditionVariableSRW AddDllDirectory WakeAllConditionVariable SetUnhandledExceptionFilter Module32NextW SetDefaultDllDirectories VirtualProtect GetModuleFileNameA QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock WriteProcessMemory FindFirstFileA SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle WriteFile DeviceIoControl VirtualAlloc FindNextFileA FindClose WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetLastError GetFileAttributesA Process32NextW CreateFileA LoadLibraryA DeleteFileA Process32FirstW CloseHandle WritePrivateProfileStringA FlushConsoleInputBuffer CreateFileMappingA ReadProcessMemory CreateProcessA CreateDirectoryA MapViewOfFile GetPrivateProfileIntA lstrcmpiW GetPrivateProfileStringA VirtualQueryEx MultiByteToWideChar GlobalAlloc GlobalFree Thread32First

user32

TrackMouseEvent GetKeyState GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId DispatchMessageA GetWindowRect DestroyWindow IsWindowVisible SetWindowPos SetMessageExtraInfo keybd_event GetSystemMetrics ScreenToClient GetCapture OpenClipboard ShowWindow IsWindow GetKeyNameTextA GetAsyncKeyState IsHungAppWindow SetWindowLongA GetWindowLongA SetWindowDisplayAffinity MapVirtualKeyA MessageBoxA EnumWindows DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage LoadIconW FindWindowW LoadCursorW GetClientRect PeekMessageA PostQuitMessage GetDesktopWindow RegisterClassExA UpdateWindow SetForegroundWindow ClientToScreen GetMessageExtraInfo

advapi32

SetSecurityInfo SetEntriesInAclW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation AddAccessAllowedAce GetLengthSid RegCloseKey InitializeAcl RegOpenKeyExA IsValidSid

shell32

ShellExecuteA

ole32

CoCreateInstance

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_id _Thrd_join ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

d3d11

D3D11CreateDeviceAndSwapChain

gdiplus

GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipBitmapUnlockBits GdipGetImageHeight GdipGetImageWidth GdipAlloc GdipFree GdipBitmapLockBits

shlwapi

ord12

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Release/loader.dll

IMPHASH 1b5b5b4032908bbd119ef7f7d2031445
SHA256 a05d2429feac58d11614452baf855fc2a544d358f9c921c4af72f6de2b930eca
MD5 4cb8b0d078ebbf7c665f97e6b8751569
SHA1 b54ce3fc6ca38128a70acd790a07e096d0388767
SHA512 0bc49f43894f16d34f826d508018189336a7227f5b2699aa29c5cb95eb4f7f6a74dfdf24848fb236fead4642be64afd788f49bc8c06c2e2a827ed9fd34f463a7
SSDEEP 1536:wzp5OlwlrLjodwS5bgkYYLAtRTqPKb2c+gPINHspglNYy3fCYYmzPiHi:XKFwnPYltZqPKpINMpgl6mZYmzPi
TLSH
T1FFB30297B20048DAC67846F916831E01F9D0BC1447A5B3D32B3BA7DF9DA03C8A175EA9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Release.rar

Release/RetracCheat.exe

dwmapi

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

vcruntime140_1

vcruntime140

kernel32

user32

advapi32

shell32

ole32

msvcp140

d3d11

gdiplus

shlwapi

imm32

d3dcompiler_47

api-ms-win-crt-locale-l1-1-0

generic

Release/loader.dll

kernel32

generic