renaissance (2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
renaissance (2).exe
Size 7.4MB
Sample261014-l67ffabt7x
SHA256 653f05fa512d4f3f46823cb7c648dfb32ec96b4f511c1a1a89f9eec7793d652c
MD5 fbeb1a9aa404a7e2d54b209c031fc0a6
SHA1 4425453906052b7fd3c7bb8b46b000feae0d0390
SHA512 92886666cf401e62d5adcf2a9a39894b0c12189349406a37c9e9882a5bd0362b7117ba4ed77011b538b4fbb8c537b493c7aaf1cf3d8ae907b6fc2295030936f3
SSDEEP 196608:hrycAZVGDmGWM1unzMuyfhSk8TeUhsjpz:hymDmiyLyJS9
TLSH
T18D760106E19786A8DF729B3995565333D6B07CC503B1C3C76B9C4D62AB93AF09ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
renaissance (2).exe

File Explorer

renaissance (2).exe

.exe 7.4MB

renaissance (2).exe

IMPHASH f17cdc2858d569dca18bf8fc6c5e70f8
SHA256 653f05fa512d4f3f46823cb7c648dfb32ec96b4f511c1a1a89f9eec7793d652c
MD5 fbeb1a9aa404a7e2d54b209c031fc0a6
SHA1 4425453906052b7fd3c7bb8b46b000feae0d0390
SHA512 92886666cf401e62d5adcf2a9a39894b0c12189349406a37c9e9882a5bd0362b7117ba4ed77011b538b4fbb8c537b493c7aaf1cf3d8ae907b6fc2295030936f3
SSDEEP 196608:hrycAZVGDmGWM1unzMuyfhSk8TeUhsjpz:hymDmiyLyJS9
TLSH
T18D760106E19786A8DF729B3995565333D6B07CC503B1C3C76B9C4D62AB93AF09ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1158328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmUpdateThumbnailProperties DwmUnregisterThumbnail DwmRegisterThumbnail DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegQueryValueExW GetUserNameA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpConnect WinHttpSendRequest

bcrypt

BCryptGetProperty BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider

kernel32

GetFileInformationByHandleEx SleepConditionVariableSRW GetCurrentThreadId LocalFree FormatMessageA GetLocaleInfoEx FindClose GetLastError AreFileApisANSI CreateFile2 SetPriorityClass GetCurrentProcess WriteFile SetThreadPriority WaitForSingleObject OpenProcess Sleep GetTempPathA CreateFileA GetCurrentThread LoadLibraryA QueryPerformanceFrequency DeleteFileA CloseHandle GetProcAddress GetCurrentProcessId CreateProcessA QueryPerformanceCounter InitializeSListHead DeviceIoControl GetVolumeInformationA WakeAllConditionVariable GetSystemInfo GetDiskFreeSpaceExA GetComputerNameA GetTickCount64 WriteProcessMemory ReadProcessMemory VirtualFreeEx MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock FreeLibrary GetModuleHandleW VirtualProtectEx GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA FindFirstFileW GetFileAttributesExW AcquireSRWLockExclusive GetSystemTimeAsFileTime GetStartupInfoW GetSystemDirectoryA SetUnhandledExceptionFilter ReleaseSRWLockExclusive GetSystemFirmwareTable

user32

DestroyWindow EnumDisplayMonitors UnregisterClassW RegisterClassExW ShowWindow SetForegroundWindow IsWindow GetMonitorInfoW EnumDisplayDevicesW EnumDisplaySettingsW DefWindowProcW CreateWindowExW MapWindowPoints SetWindowDisplayAffinity MoveWindow SetLayeredWindowAttributes GetSystemMetrics GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetWindowLongW GetAsyncKeyState TranslateMessage SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData BringWindowToTop SetWindowPos SetClipboardData DispatchMessageW PeekMessageW GetForegroundWindow

gdi32

GetStockObject

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Thrd_id _Thrd_join ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

winmm

timeBeginPeriod

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memchr memcmp memmove strrchr longjmp memset __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp strstr __std_terminate __std_exception_copy __std_exception_destroy memcpy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

terminate _errno abort _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _c_exit _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _beginthreadex

api-ms-win-crt-stdio-l1-1-0

fflush fclose __p__commode fgetc fputc __acrt_iob_func __stdio_common_vsprintf fwrite fgetpos setvbuf ungetc _set_fmode fsetpos fread _fseeki64 __stdio_common_vsscanf _wfopen _get_stream_buffer_pointers __stdio_common_vfprintf fseek ftell

api-ms-win-crt-math-l1-1-0

logf log atan2f ceilf cosf fmodf powf roundf sinf sqrtf acosf __setusermatherr _dclass pow _dsign

api-ms-win-crt-convert-l1-1-0

strtol atoi strtoull atof strtod strtoll

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s wcslen strncpy _wcsicmp tolower strlen strcmp

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime