ripper[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ripper.exe
Size 7.1MB
Sample261017-yle7nsgf64
SHA256 4fa4785deef3fb9bc9df4fddcb54023191df31fae237235eb790db6e8a1a28d0
MD5 e2f807082c61947738a412d5c7e0e8a9
SHA1 22ada656108c39bd515f7ced87692d824004a78f
SHA512 50aafa442b5b3e17d0ae87189e49350a2e89b9790119f9bb2a94690f2dfa095bb4098c79117087da352d5762948c15b250bdd97965f9590a47b950cdc3ee5f86
SSDEEP 49152:CX26Kzk1CTTHwyx7NxM+FZ8MmUVY5H+rDWFMBd2NFOXCswAyHtX9TSH8x3KuKPfJ:CXdK5HdAQZNmo4eriFMBGQMKzYbqhP+
TLSH
T127767B02B65B99ECD05AC8B0934696735E2274CB0B36B9FF41C855383F6ABE05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ripper.exe

File Explorer

ripper.exe

.exe 7.1MB

ripper.exe

IMPHASH 6f0c014d32f65d402ee38afe695c301a
SHA256 4fa4785deef3fb9bc9df4fddcb54023191df31fae237235eb790db6e8a1a28d0
MD5 e2f807082c61947738a412d5c7e0e8a9
SHA1 22ada656108c39bd515f7ced87692d824004a78f
SHA512 50aafa442b5b3e17d0ae87189e49350a2e89b9790119f9bb2a94690f2dfa095bb4098c79117087da352d5762948c15b250bdd97965f9590a47b950cdc3ee5f86
SSDEEP 49152:CX26Kzk1CTTHwyx7NxM+FZ8MmUVY5H+rDWFMBd2NFOXCswAyHtX9TSH8x3KuKPfJ:CXdK5HdAQZNmo4eriFMBGQMKzYbqhP+
TLSH
T127767B02B65B99ECD05AC8B0934696735E2274CB0B36B9FF41C855383F6ABE05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4292436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ripper.pdb

kernel32

GlobalFree GlobalSize WideCharToMultiByte SwitchToThread CloseHandle GetProcAddress GetCurrentThreadId FormatMessageW LoadLibraryW FreeLibrary SetThreadErrorMode LoadLibraryExW Sleep GetModuleHandleA CreateThread SetFilePointerEx GetProcessId FindClose ReadFileEx SleepEx GlobalMemoryStatusEx WaitForSingleObject GetExitCodeProcess GetSystemTimePreciseAsFileTime CompareStringOrdinal WriteFileEx SetLastError GetFullPathNameW GetStdHandle GetCurrentProcess DuplicateHandle QueryPerformanceCounter SetHandleInformation GetCurrentProcessId CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW MultiByteToWideChar CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW ExitProcess GetSystemInfo WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW GetEnvironmentVariableW HeapAlloc GetModuleFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW GetModuleHandleW IsThreadAFiber FlsSetValue GetTempPathW QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW LoadLibraryExA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GlobalUnlock GetCurrentThread GlobalLock GlobalAlloc HeapReAlloc GetLastError HeapFree CreateProcessW GetProcessHeap

shell32

DragFinish SHGetFolderPathW SHCreateItemFromParsingName DragQueryFileW

bcryptprimitives

ProcessPrng

oleaut32

SysAllocStringLen SysStringLen SysFreeString SafeArrayPutElement SafeArrayCreateVector SetErrorInfo GetErrorInfo VariantClear

user32

CallWindowProcW DefWindowProcW ClientToScreen RemovePropW ReleaseDC DestroyWindow PostMessageW GetMonitorInfoW MonitorFromPoint IsWindowVisible RedrawWindow SystemParametersInfoA PeekMessageW TranslateMessage DispatchMessageW GetWindowLongPtrW EnumDisplayMonitors GetClientRect IsIconic GetPropW SetPropW SetWindowLongPtrW RegisterRawInputDevices TrackMouseEvent CreateIconFromResourceEx GetActiveWindow GetSystemMetrics ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx IsProcessDPIAware GetAsyncKeyState GetKeyState DestroyCursor RegisterWindowMessageA SetWindowDisplayAffinity ShowCursor ClipCursor GetClipCursor DestroyIcon CreateIcon GetKeyboardState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx AdjustWindowRectEx SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow GetWindowTextW GetWindowTextLengthW GetWindowLongW SetCapture MonitorFromRect ScreenToClient GetMenu ReleaseCapture GetCursorPos CreateWindowExW RegisterClassExW GetClassInfoExW GetClassNameW GetDC SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow SetCursorPos SetWindowTextW GetWindowRect FlashWindowEx MonitorFromWindow SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW SetCursor LoadCursorW InvalidateRgn SetWindowPos SendMessageW EmptyClipboard SetClipboardData CloseClipboard IsClipboardFormatAvailable GetClipboardData RegisterClipboardFormatW OpenClipboard GetTouchInputInfo CloseTouchInputHandle RegisterTouchWindow

uiautomationcore

UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent

gdi32

DeleteObject CreateRectRgn GetDeviceCaps SetPixelFormat ChoosePixelFormat DescribePixelFormat SwapBuffers

ole32

CoTaskMemFree CoCreateInstance CoCreateFreeThreadedMarshaler OleInitialize CoInitializeEx CoUninitialize RegisterDragDrop RevokeDragDrop

ntdll

NtReadFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

shlwapi

AssocQueryStringW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcrypt

BCryptGenRandom

advapi32

ImpersonateAnonymousToken SystemFunction036 RevertToSelf

opengl32

wglGetCurrentContext wglCreateContext wglGetProcAddress wglGetCurrentDC wglMakeCurrent wglDeleteContext wglShareLists

imm32

ImmGetCompositionStringW ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx ImmReleaseContext

ws2_32

getsockopt closesocket getaddrinfo WSARecv getpeername send WSASend freeaddrinfo listen bind WSAStartup WSAGetLastError setsockopt ioctlsocket getsockname WSADuplicateSocketW WSASocketW select connect recv

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memcmp __CxxFrameHandler3 memmove memcpy memset

api-ms-win-crt-math-l1-1-0

floorf ceilf __setusermatherr trunc floor powf sinf roundf _hypotf sin fmodf cos atan2f expf round truncf exp2f cosf cbrtf acosf

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

strerror _crt_atexit _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _initialize_onexit_table _wassert _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit terminate _exit

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale