Rocket Swap Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Rocket Swap Installer.exe
Size 1.5MB
Sample261011-vrexbaea23
SHA256 42f9c291b12d93406fa7593b2015fdea874b32956d5f237489b98d484aed0583
MD5 75812d1b7dd868da2e5eaccdfafa1a8c
SHA1 2309399a38caad0bfeda7b3b8ff4972e1c2d3f76
SHA512 720133e3bcfee6d7ba8e82bb8f088a9a555757e331ccafd688906ad5be70590255caa18b98ca7f389118a65cd5d503a3301a4e895dad4f4e2ec8baa9fe469f07
SSDEEP 24576:KJnfZ9z0Ejq3cunaqZPiKn5+5BJj/yr/5IcAfdhDXxu1XcAVe1:KBz0E8c8oKn057jA/5ITutlw
TLSH
T14975D055F2A841FDD467D538CEA2A60BE632744A07306ADB13D05A9D3F737E04ABB702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Rocket Swap Installer.exe

File Explorer

Rocket Swap Installer.exe

.exe 1.5MB

Rocket Swap Installer.exe

IMPHASH 26bc70d9d481d05d5b47361db7f74a5a
SHA256 42f9c291b12d93406fa7593b2015fdea874b32956d5f237489b98d484aed0583
MD5 75812d1b7dd868da2e5eaccdfafa1a8c
SHA1 2309399a38caad0bfeda7b3b8ff4972e1c2d3f76
SHA512 720133e3bcfee6d7ba8e82bb8f088a9a555757e331ccafd688906ad5be70590255caa18b98ca7f389118a65cd5d503a3301a4e895dad4f4e2ec8baa9fe469f07
SSDEEP 24576:KJnfZ9z0Ejq3cunaqZPiKn5+5BJj/yr/5IcAfdhDXxu1XcAVe1:KBz0E8c8oKn057jA/5ITutlw
TLSH
T14975D055F2A841FDD467D538CEA2A60BE632744A07306ADB13D05A9D3F737E04ABB702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

479408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

gdiplus

GdipStartPathFigure GdipDeleteGraphics GdipGetImageWidth GdipTranslateWorldTransform GdipCreateBitmapFromScan0 GdipSaveImageToFile GdipGetImageEncodersSize GdiplusStartup GdiplusShutdown GdipAddPathLine GdipGetImageHeight GdipAddPathBezier GdipSaveGraphics GdipCloneImage GdipBitmapUnlockBits GdipDeleteBrush GdipCreateBitmapFromStream GdipAlloc GdipGetImageEncoders GdipDeletePath GdipDisposeImage GdipSetSmoothingMode GdipCreatePath GdipCreateSolidFill GdipFillPath GdipGraphicsClear GdipScaleWorldTransform GdipFree GdipBitmapLockBits GdipRestoreGraphics GdipGetImageGraphicsContext

winhttp

WinHttpReceiveResponse WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen

shell32

SHGetKnownFolderPath ShellExecuteW CommandLineToArgvW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance StringFromGUID2 CoCreateGuid CoInitializeEx CoUninitialize

dwmapi

DwmSetWindowAttribute

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc SetStdHandle GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent FlsSetValue FlsGetValue FlsAlloc SetLastError GetFileType CreateFileW ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread SizeofResource GetCommandLineW GetModuleFileNameW Sleep LockResource SetEndOfFile GlobalFree LoadResource FindResourceW GlobalLock LocalFree WideCharToMultiByte GlobalUnlock MulDiv CreateMutexW GetFileAttributesW ReleaseMutex MultiByteToWideChar GetLastError CloseHandle GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter OutputDebugStringA RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime FlsFree GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable GetFileInformationByHandleEx MoveFileExW GetModuleHandleW AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW CreateThread HeapSize WriteConsoleW GlobalAlloc RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesExW

user32

GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetClipboardData GetCursorPos DefWindowProcW DestroyWindow SetWindowPos MessageBoxW GetDpiForWindow AdjustWindowRectExForDpi CreateWindowExW RegisterClassExW ShowWindow DispatchMessageW TranslateMessage LoadIconW LoadCursorW GetClientRect PostQuitMessage GetDpiForSystem IsIconic EmptyClipboard SetClipboardData CloseClipboard OpenClipboard PeekMessageW

Name

.text

Size

664KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

628KB

Virtual Size

627KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Rocket Swap Installer.exe

d3d11

d3dcompiler_47

gdiplus

winhttp

shell32

ole32

dwmapi

kernel32

user32

generic