r1dbz18[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
r1dbz18.rar
Size 6.7MB
Sample261107-y3bktafx2k
SHA256 3095921d81815e894253b3142693f1b9a61f9f2ff0855614d0dd555bcf8a90c2
MD5 fc2001e65e9c3daa6a87129fa5265464
SHA1 08eb7d9b03bdf86a81ec7a456821890aabfc35ef
SHA512 55f250007906879138d793f49d6d7df9174f4360b598c559442c692e05de9348db4a5c71a7faa6bced6eca36d69e7534fca59f4e91fa4654a51bfb035b29f285
SSDEEP 196608:y3yLo7QIRmim6s5MNWSx0elSjzhwyfwIh5iU1Y:RLBIRmLmNWSt8feyf15lq
TLSH
T1416633F8B73311712F3C7D704795F8063AB91A566C99B42F6E6243287254FBC2E88267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PINK V3.8.exe

File Explorer

r1dbz18.rar

.rar 6.7MB
PINK V3.8.exe

.exe 9.5MB

r1dbz18.rar

SHA256 3095921d81815e894253b3142693f1b9a61f9f2ff0855614d0dd555bcf8a90c2
MD5 fc2001e65e9c3daa6a87129fa5265464
SHA1 08eb7d9b03bdf86a81ec7a456821890aabfc35ef
SHA512 55f250007906879138d793f49d6d7df9174f4360b598c559442c692e05de9348db4a5c71a7faa6bced6eca36d69e7534fca59f4e91fa4654a51bfb035b29f285
SSDEEP 196608:y3yLo7QIRmim6s5MNWSx0elSjzhwyfwIh5iU1Y:RLBIRmLmNWSt8feyf15lq
TLSH
T1416633F8B73311712F3C7D704795F8063AB91A566C99B42F6E6243287254FBC2E88267
MD5 SHA1 SHA512 SSDEEP TLSH

PINK V3.8.exe

IMPHASH b84f3e2dd9a14123371752cf1e0a862b
SHA256 8daf85e2c161603675eea1b9138d8c2247dd6319efe027d21775bcb13511ed83
MD5 17c58cc34c62d8e357151044bfaf71ad
SHA1 01230c0dcbd5c149c52973096f3822463bfc093d
SHA512 d1c4835476e7cfc2f6f0cd6b54938ff2f410434ea9e1e0d9905748623ee76683d0dc50596dbb609a5a522ae80f0ff0c0984eb3066a3fe5067a08a88a61bddb21
SSDEEP 196608:Cz4jbmFC9gwFqPrvhEUZGAQ0ZUa9c1GlwNd+Y8KHc7Wh8Oyg:Cz4jbmFC9gwFYzhEUlQ0jK8aAXy
TLSH
T1CAA60246B3A500F8D577C178CA67931BE735740507309BEB23D84AA96F63BE06BBA701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1220620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

CreateDirectoryW FindClose FindFirstFileW SleepEx GetSystemDirectoryW GetFileAttributesW GetFileAttributesExW LocalFree GetFileInformationByHandle LeaveCriticalSection GetTempPathW AreFileApisANSI EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive CopyFileW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe GetFileType WaitForSingleObjectEx MoveFileExW GetTickCount SetDllDirectoryW ReleaseSRWLockExclusive FormatMessageW SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW DeleteCriticalSection GetSystemTimeAsFileTime InitializeSListHead InitializeCriticalSectionEx OutputDebugStringW CreateFileA GetFileSizeEx HeapAlloc VirtualFreeEx HeapFree K32EnumProcessModules CreateRemoteThread VirtualAllocEx Process32FirstW Process32NextW GetLastError GetTempPathA GetExitCodeThread CreateToolhelp32Snapshot GetEnvironmentVariableA CreatePipe K32GetModuleFileNameExW GetModuleFileNameW GetStdHandle WriteProcessMemory ReadFile CreateProcessA GetModuleHandleW GetCurrentProcessId ExitProcess CloseHandle Sleep MapViewOfFile UnmapViewOfFile OpenProcess WaitForSingleObject TerminateProcess GetCurrentProcess GetModuleFileNameA LoadLibraryW QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree CreateFileMappingA GetCurrentDirectoryW GlobalAlloc MultiByteToWideChar CreateFileW

user32

TrackMouseEvent GetWindowTextW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW DispatchMessageW SetWindowLongA PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow GetWindowRect ShowWindow MoveWindow GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetWindowLongW ClientToScreen GetCapture ScreenToClient

advapi32

CheckTokenMembership FreeSid CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegQueryValueExA RegOpenKeyExA AllocateAndInitializeSid

shell32

ShellExecuteExA SHGetFolderPathA SHGetKnownFolderPath ShellExecuteA

ole32

CoTaskMemFree

msvcp140

?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??Bios_base@std@@QEBA_NXZ

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpReceiveResponse

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertCreateCertificateChainEngine

ws2_32

recvfrom sendto freeaddrinfo WSAGetLastError getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect closesocket inet_pton ntohs WSASetLastError inet_ntop bind connect getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo gethostname ioctlsocket

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception wcschr strchr _CxxThrowException __std_exception_destroy memchr memset memmove memcpy __std_terminate strrchr strstr memcmp __std_exception_copy wcsstr longjmp

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fflush fclose fseek _wopen __stdio_common_vfprintf __acrt_iob_func feof fputs fwrite _wfopen _set_fmode __p__commode __stdio_common_vsprintf fread _read _write __stdio_common_vsscanf fputc fputwc _fileno _close ftell _get_stream_buffer_pointers _fseeki64 fsetpos fgets setvbuf fgetpos ungetwc fgetc fgetwc ungetc

api-ms-win-crt-runtime-l1-1-0

abort exit _beginthreadex terminate _errno _invalid_parameter_noinfo_noreturn __sys_errlist __sys_nerr _invoke_watson _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strpbrk strcpy_s strcmp strncpy_s wcsncmp _wcsicmp towlower strspn wcspbrk strncmp wcsncpy _strdup strncpy strcspn

api-ms-win-crt-heap-l1-1-0

malloc calloc realloc _set_new_mode free _callnewh

api-ms-win-crt-convert-l1-1-0

wcstombs strtoll strtoul atoi strtol

api-ms-win-crt-math-l1-1-0

_fdopen __setusermatherr sqrtf acosf cosf fmodf powf sinf ceilf

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _fstat64 _unlink _wstat64 _lock_file

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 strftime

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale