rcedit-x64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rcedit-x64.exe
Size 1.3MB
Sample261024-2tbe8ssw4j
SHA256 3e7801db1a5edbec91b49a24a094aad776cb4515488ea5a4ca2289c400eade2a
MD5 e0cb28bf051d6311c1dca32f392c7d5e
SHA1 d210d5297a17a15deec1c19359b6f9fe1861092e
SHA512 c13e7ffd60169c348e16a3ea59a171c1777acdb241f950c11a6e9b69c955a3a4eb3432182aee7f489a87a555d0bd51fde3b597826f7c1e6488f1f5097359ab4d
SSDEEP 12288:FT8MNbCKEQibPsFC8KQiQE2EEKE3N47wLIFaVGO0B/FvrC0R1qKNlKbNbGEzET1N:vbCs3gfEQT1UtsocI/+c
TLSH
T190558E6A339812D5E1B7D17DC9968B4ED6B17809432157CB01E846EA2F27BF80E3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rcedit-x64.exe

File Explorer

rcedit-x64.exe

.exe 1.3MB

rcedit-x64.exe

IMPHASH 9831596d21f47de94666020b06981cb9
SHA256 3e7801db1a5edbec91b49a24a094aad776cb4515488ea5a4ca2289c400eade2a
MD5 e0cb28bf051d6311c1dca32f392c7d5e
SHA1 d210d5297a17a15deec1c19359b6f9fe1861092e
SHA512 c13e7ffd60169c348e16a3ea59a171c1777acdb241f950c11a6e9b69c955a3a4eb3432182aee7f489a87a555d0bd51fde3b597826f7c1e6488f1f5097359ab4d
SSDEEP 12288:FT8MNbCKEQibPsFC8KQiQE2EEKE3N47wLIFaVGO0B/FvrC0R1qKNlKbNbGEzET1N:vbCs3gfEQT1UtsocI/+c
TLSH
T190558E6A339812D5E1B7D17DC9968B4ED6B17809432157CB01E846EA2F27BF80E3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18241

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\rcedit\rcedit\build\x64\RelWithDebInfo\rcedit.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

GetModuleHandleW SetEndOfFile WriteConsoleW GetCurrentDirectoryW GetLastError SetLastError GetModuleFileNameW CreateFileW GetFileSize ReadFile SetFilePointer DecodePointer CloseHandle HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW FreeLibrary FreeResource LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW EnumResourceNamesW EnumResourceLanguagesW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW SetCurrentDirectoryW ReadConsoleW SetStdHandle LocalFree FormatMessageA GetLocaleInfoEx WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RtlUnwind QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress GetFullPathNameW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetDriveTypeW SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

user32

UnregisterClassW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

671B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rcedit-x64.exe

version

kernel32

user32

generic