rFactorDec[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rFactorDec.exe
Size 237KB
Sample261027-rr72bavscz
SHA256 5ccc94f9b5d9fa5779b5bcea720f729778cbe54b8dc31da52705aa2ca21e1fe8
MD5 c09384e1d4262837a2ee9667981040b8
SHA1 6ac6cbf2219f1c8e0577a9b21b942bd4bd36724a
SHA512 eddb25e0fa396fd2c8f5bca604802ad7fe850426b29e9efe1264b2b37fb72756f5fb7bf7822927ed6ea79918288dbd33403e01293afcac725a6ac5109b2d8cff
SSDEEP 3072:aT/BcZQZFyjs8CXlsfZbEaQ7ifWmNpj7V8Lr7v9Eqwif61ESCnKKIKW:aT/vyA1XsbqiVzjuLfFEhh66KW
TLSH
T1E5349D5977A40CF9FCB3823DCA529A46EB7278150760DBDF03A00666AF236D05D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rFactorDec.exe

File Explorer

rFactorDec.exe

.exe 237KB

rFactorDec.exe

IMPHASH 942c94acb8b8866f24863ca7495bdbe8
SHA256 5ccc94f9b5d9fa5779b5bcea720f729778cbe54b8dc31da52705aa2ca21e1fe8
MD5 c09384e1d4262837a2ee9667981040b8
SHA1 6ac6cbf2219f1c8e0577a9b21b942bd4bd36724a
SHA512 eddb25e0fa396fd2c8f5bca604802ad7fe850426b29e9efe1264b2b37fb72756f5fb7bf7822927ed6ea79918288dbd33403e01293afcac725a6ac5109b2d8cff
SSDEEP 3072:aT/BcZQZFyjs8CXlsfZbEaQ7ifWmNpj7V8Lr7v9Eqwif61ESCnKKIKW:aT/vyA1XsbqiVzjuLfFEhh66KW
TLSH
T1E5349D5977A40CF9FCB3823DCA529A46EB7278150760DBDF03A00666AF236D05D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SendMessageA DispatchMessageA TranslateMessage DefWindowProcA PostQuitMessage RegisterClassExA SystemParametersInfoA LoadIconA LoadCursorA GetDesktopWindow SetWindowLongPtrA GetWindowLongPtrA ChildWindowFromPoint MessageBoxA GetWindowRect GetClientRect GetWindowTextLengthA GetWindowTextA SetWindowTextA UpdateWindow TranslateAcceleratorA DestroyAcceleratorTable CreateAcceleratorTableA EnableWindow IsDlgButtonChecked GetDlgItem GetWindowPlacement SetWindowPos MoveWindow ShowWindow DestroyWindow CreateWindowExA GetMessageA

comdlg32

GetSaveFileNameA GetOpenFileNameA

comctl32

InitCommonControlsEx

shell32

DragQueryPoint DragFinish DragAcceptFiles ShellExecuteA SHCreateItemFromParsingName SHGetFolderPathA DragQueryFileW

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

gdi32

GetStockObject

kernel32

GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFullPathNameW GetCurrentDirectoryW SetFilePointerEx GetFileSizeEx ReadConsoleW FlushFileBuffers GetProcessHeap LCMapStringW CompareStringW VirtualProtect GetTimeZoneInformation HeapSize WriteConsoleW SetEndOfFile InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetStdHandle HeapReAlloc HeapFree HeapAlloc QueryPerformanceCounter GetStdHandle GetCurrentDirectoryA CreateDirectoryA FindClose FindFirstFileA FindNextFileA GetFileAttributesW ReadFile CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject WaitForMultipleObjects TerminateProcess CreateThread CreateProcessA GetSystemInfo GetModuleFileNameA GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA CopyFileA MultiByteToWideChar WideCharToMultiByte GetConsoleWindow RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile GetModuleFileNameW

Name

.text

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rFactorDec.exe

user32

comdlg32

comctl32

shell32

ole32

gdi32

kernel32

generic