$RBNEV8F[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
$RBNEV8F.exe
Size 5.5MB
Sample261011-cta22acy8m
SHA256 39c659d3a645ea0d0c27a04adb7c0b503c14bb5a9fb40cc55698f2cb033d9e47
MD5 d5bf7ea77fb50f59b18dbdac7bdd172a
SHA1 c3650ff22332ca58e893f36dd1b3d7035c5ef7b6
SHA512 be5b8041881b974bcb100a656b3ec5f6d254bff3bcf8a56aca9238f59e6aaaae9428daabee7174ba2b61be032829899b6114a697724877c98878d16db1cf4b72
SSDEEP 98304:nSyCXQ6W2RjeXuIMDDMqAy7XevbU+sOo1:Vc3L7fko
TLSH
T11246BE03F395C1ECC05AC0748356A233EA73F8894B35B2AB6BC45B216E66B909F1D75D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
$RBNEV8F.exe

File Explorer

$RBNEV8F.exe

.exe 5.5MB

$RBNEV8F.exe

IMPHASH c59a41f9551d5de3341cf7844e7c70d4
SHA256 39c659d3a645ea0d0c27a04adb7c0b503c14bb5a9fb40cc55698f2cb033d9e47
MD5 d5bf7ea77fb50f59b18dbdac7bdd172a
SHA1 c3650ff22332ca58e893f36dd1b3d7035c5ef7b6
SHA512 be5b8041881b974bcb100a656b3ec5f6d254bff3bcf8a56aca9238f59e6aaaae9428daabee7174ba2b61be032829899b6114a697724877c98878d16db1cf4b72
SSDEEP 98304:nSyCXQ6W2RjeXuIMDDMqAy7XevbU+sOo1:Vc3L7fko
TLSH
T11246BE03F395C1ECC05AC0748356A233EA73F8894B35B2AB6BC45B216E66B909F1D75D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptGenRandom

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

uxtheme

SetWindowTheme

kernel32

GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW SetThreadErrorMode GetModuleHandleA CancelIoEx CloseHandle CopyFileExW CreateDirectoryW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FreeLibrary GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetOverlappedResult GetProcessId GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GlobalFree InitOnceBeginInitialize InitOnceComplete IsThreadAFiber MoveFileExW OpenProcess PostQueuedCompletionStatus QueryFullProcessImageNameW ReadFile ReadFileEx SetConsoleMode SetConsoleTextAttribute SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WriteConsoleW WriteFile WriteFileEx AddVectoredExceptionHandler CompareStringOrdinal CreateFileMappingA CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetModuleHandleW GetProcessHeap GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WideCharToMultiByte __C_specific_handler lstrlenW

bcryptprimitives

ProcessPrng

advapi32

ImpersonateAnonymousToken RevertToSelf RegCloseKey RegCreateKeyExW RegDeleteTreeW RegSetValueExW SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

gdi32

ChoosePixelFormat CreateRectRgn DeleteObject DescribePixelFormat GetDeviceCaps SetPixelFormat SwapBuffers

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _fpreset _hypot _initterm _onexit abort acosf atan2f calloc ceil ceilf cosf exit expf floor floorf fprintf free frexp fwrite malloc memcmp memcpy memmove memset powf signal sinf strerror strlen strncmp vfprintf

opengl32

wglCreateContext wglDeleteContext wglGetCurrentContext wglGetCurrentDC wglGetProcAddress wglMakeCurrent wglShareLists

shell32

DragFinish DragQueryFileW SHGetKnownFolderPath

shlwapi

AssocQueryStringW

user32

AdjustWindowRectEx ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CloseTouchInputHandle CreateIcon CreateIconFromResourceEx CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DispatchMessageW EmptyClipboard EnableMenuItem EnumDisplayMonitors EnumThreadWindows FlashWindowEx GetActiveWindow GetAsyncKeyState GetClassInfoExW GetClassNameW GetClientRect GetClipCursor GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMessageW GetMonitorInfoW GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRgn IsClipboardFormatAvailable IsIconic IsProcessDPIAware KillTimer LoadCursorW MapVirtualKeyExW MapVirtualKeyW MonitorFromPoint MonitorFromRect MonitorFromWindow OpenClipboard PeekMessageW PostMessageW RedrawWindow RegisterClassExW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC ScreenToClient SendInput SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetTimer SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TranslateMessage ValidateRect

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

$RBNEV8F.exe

bcrypt

dwmapi

imm32

ole32

uxtheme

kernel32

bcryptprimitives

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

ws2_32

gdi32

msvcrt

opengl32

shell32

shlwapi

user32

generic