rtdt[.]bin | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

rtdt.bin
Size

324KB
MD5

f1df801459853f42662c0f947518d3e7
SHA1

15e292ab8c863f2ba97244ed3f6cb226980580e9
SHA256

b02e02ff9b225ad1d2d295800005675fbf2dacd2899b5b939e1070aa2de623e1
SHA512

a06911c0e062dc0d6d8803ea4a0332ea8097839d03f3a382b104e78c82d57685aa199033c582936823115253a65f0883e4d0b76c8988d7319e5bed29f9618d13

Score

N/A

Malware Config

Signatures

Files

rtdt.bin
.dll windows x86

5f924cb1f20ffb4417faecd61558372b

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExA
RegEnumValueA
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegDeleteKeyW

user32

SetClassLongA
LoadStringA

kernel32

CompareStringW
CompareStringA
GetLocaleInfoW
VirtualAlloc
GetModuleHandleA
GetProcAddress
LoadLibraryExA
GetLastError
FindResourceA
lstrlenA
SetStdHandle
LCMapStringW
GetACP
GetOEMCP
CloseHandle
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
UnhandledExceptionFilter
GetCPInfo
HeapReAlloc
IsBadWritePtr
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sleep
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
SetEnvironmentVariableA

Exports

Exports

phone

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f924cb1f20ffb4417faecd61558372b

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

kernel32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.bss Size: - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 260KB - Virtual size: 259KB

.tls Size: 4KB - Virtual size: 40B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 44KB - Virtual size: 40KB

.bss
Size: - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 260KB - Virtual size: 259KB

.tls
Size: 4KB - Virtual size: 40B

.reloc
Size: 4KB - Virtual size: 3KB