Binary[.]u9RapNSB[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Binary.u9RapNSB.exe
Size 5.1MB
Sample261113-pdgabsvs9p
SHA256 5f41323f4d0bc83a13b9859fe03db8aa3c13a0779bf69ea507e0ba9cf9f620d1
MD5 76b2f4634f805a29604346adcef2a566
SHA1 d79f8157bbe699679fee210fc9579a21ac781910
SHA512 6dfad6fa654a8d8fbe851a53400039fb0988d030a60b5b32829eda4a9dfd2865f6956ae85c0acba580b6b1d1bc6d3a1fe0a0d1907dd59a26b0c3d98fd61d37b9
SSDEEP 49152:tsWhue3r0VMrhIHADau+h4Rc9H5PpzV5qtHA4s+K5lnYrZS+:buOrh9DVEeSxtVoKvAS+
TLSH
T195463329B2C225F9E87381349D921614FFB13826172066EB43D845339F379E61EBF726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Binary.u9RapNSB.exe

File Explorer

Binary.u9RapNSB.exe

.exe 5.1MB

Binary.u9RapNSB.exe

IMPHASH 19bd7c45968741534a5c699dc25863fb
SHA256 5f41323f4d0bc83a13b9859fe03db8aa3c13a0779bf69ea507e0ba9cf9f620d1
MD5 76b2f4634f805a29604346adcef2a566
SHA1 d79f8157bbe699679fee210fc9579a21ac781910
SHA512 6dfad6fa654a8d8fbe851a53400039fb0988d030a60b5b32829eda4a9dfd2865f6956ae85c0acba580b6b1d1bc6d3a1fe0a0d1907dd59a26b0c3d98fd61d37b9
SSDEEP 49152:tsWhue3r0VMrhIHADau+h4Rc9H5PpzV5qtHA4s+K5lnYrZS+:buOrh9DVEeSxtVoKvAS+
TLSH
T195463329B2C225F9E87381349D921614FFB13826172066EB43D845339F379E61EBF726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetOEMCP WriteConsoleW CreateFileW CloseHandle GetACP GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize MulDiv GetTickCount GetLocalTime GetVersion GetSystemTimeAsFileTime GetSystemInfo GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetTempPathW Sleep SetFilePointerEx GetProcessHeap LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess TerminateProcess GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW

user32

MessageBoxW IsWindowVisible FindWindowW GetWindowTextLengthW GetSystemMetrics GetForegroundWindow

gdi32

DeleteObject CreateFontW GetDeviceCaps

advapi32

RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey GetUserNameW RegQueryValueExW

ole32

CoInitializeEx CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoUninitialize

shlwapi

PathCombineW PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW StrStrW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.data

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Binary.u9RapNSB.exe

kernel32

user32

gdi32

advapi32

ole32

shlwapi

version

generic