Resolve[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Resolve.exe
Size 1.1MB
Sample261027-2p86pshs2m
SHA256 9f0fa6068e9b234660342955ec6659624ac2386cf16872546240bedaf5702dbe
MD5 3ecfb766a6a54fc5819fe173dad3f8d8
SHA1 1afea4229377cec867fafbc860b6d63018ae9d64
SHA512 b1c924e6ff1c0f039851836daa460d227b01cb34133382f6f2064fd684d2186cd694eb3c116e0e92d878d94322b7a45426fd50edf6f95fe1b486de16d0516a01
SSDEEP 12288:UK95Vccf1P5aKhAuTIJTancB4zUsJwwM+aidUu5zR:n95V7P5aKC4zUWtai
TLSH
T16135AF1663E512D9E17BC17D8DF64A95EA72780807709BCF069062E81F27FE84E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Resolve.exe

File Explorer

Resolve.exe

.exe 1.1MB

Resolve.exe

IMPHASH e4f17c465e03164cf5a30c93a0a46219
SHA256 9f0fa6068e9b234660342955ec6659624ac2386cf16872546240bedaf5702dbe
MD5 3ecfb766a6a54fc5819fe173dad3f8d8
SHA1 1afea4229377cec867fafbc860b6d63018ae9d64
SHA512 b1c924e6ff1c0f039851836daa460d227b01cb34133382f6f2064fd684d2186cd694eb3c116e0e92d878d94322b7a45426fd50edf6f95fe1b486de16d0516a01
SSDEEP 12288:UK95Vccf1P5aKhAuTIJTancB4zUsJwwM+aidUu5zR:n95V7P5aKC4zUWtai
TLSH
T16135AF1663E512D9E17BC17D8DF64A95EA72780807709BCF069062E81F27FE84E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9561

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\heheh\Downloads\RobloxExternal-base-main\RobloxExternal-base-main\Loader\x64\Release\Resolve.pdb

gdiplus

GdipFree GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipRestoreGraphics GdipSaveGraphics GdipResetClip GdipSetClipPath GdipDrawImageRectRect GdipDrawImageRectI GdipFillPath GdipFillEllipse GdipFillPolygon GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawPolygon GdipDrawEllipse GdipDrawRectangleI GdipDrawRectangle GdipDrawLine GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetPenLineJoin GdipSetPenLineCap197819 GdipDeletePen GdipCreatePen1 GdipCreateLineBrushI GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathEllipse GdipAddPathLine GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipAlloc

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpCrackUrl

kernel32

FindNextFileW FindFirstFileExW FindClose SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError GetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCommandLineW GetEnvironmentVariableW CompareFileTime CreateFileA CreateFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx ReadFile SetFilePointerEx WriteFile GetTempPathW IsValidCodePage OutputDebugStringW CheckRemoteDebuggerPresent CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess GetCurrentThread OpenThread CreateProcessW GetThreadContext GlobalMemoryStatusEx GetSystemInfo GetTickCount GetModuleFileNameW GetModuleHandleW GetProcAddress CopyFileW GetComputerNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW LocalFree CreateSymbolicLinkW GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce InitializeCriticalSectionEx SetFileInformationByHandle FormatMessageA SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetNativeSystemInfo GetExitCodeThread GetCurrentThreadId SwitchToThread WaitForSingleObjectEx GetACP GetStringTypeW RtlCaptureContext GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc ReadConsoleW WriteConsoleW IsDebuggerPresent RtlUnwind GetLocaleInfoEx

user32

LoadCursorW GetClassNameW EnumWindows ScreenToClient GetCursorPos MessageBoxW AdjustWindowRect GetClientRect GetWindowTextW InvalidateRect SetWindowRgn EndPaint BeginPaint UpdateWindow LoadImageW KillTimer SetTimer ReleaseCapture ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW ExitWindowsEx DispatchMessageW TranslateMessage GetMessageW GetSystemMetrics SetProcessDPIAware

gdi32

DeleteDC CreateRoundRectRgn CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject SelectObject

advapi32

RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey GetUserNameW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegGetValueW RegQueryValueExW

shell32

ShellExecuteExW

Name

.text

Size

857KB

Virtual Size

857KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Resolve.exe

gdiplus

winhttp

kernel32

user32

gdi32

advapi32

shell32

generic