RTXLoader_Key_OldSystems[.]rar

Resubmissions

04/07/2023, 00:20

230704-amxaksbh71 7

03/07/2023, 23:46

230703-3sb6taad89 8

Sharing

Copy URL Twitter E-mail

General

Target

RTXLoader_Key_OldSystems.rar
Size

19.3MB
MD5

e99061a48ae2ae820cb45b2e458c4a0a
SHA1

a40d1c2483876dfb65a600c0c2f40430ac46aff0
SHA256

5b73d994fa50e74ec56dce8d346fe924fd7ac5bcbeec4b32919147ea7c2b45f8
SHA512

3b6a16cb2e38ebdaa8e50dfd95a0280500a990e1ae88c9721324ad9dd80251cb454eb88057f14808d749498c2a23e8645ff88fa0d6d2d71a3f0b655294e05c55
SSDEEP

393216:ZFk1ODvYerSbHvgtoCMWGP5DlH9zUuMzr+xeFymvcnIUOopuDr3Kby:Zy1ObYerSbHvEMfVzUucFymEZpmT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/rtxloader.exe	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/libgallium_wgl.dll
unpack001/libglapi.dll
unpack001/opengl32.dll
unpack001/rtxloader.exe

Files

RTXLoader_Key_OldSystems.rar
.rar
dxil.dll
.dll windows x64

a4b371aae909065dfd71db56d9200b52

Code Sign

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:99:dd:38:7b:f4:72:e5:a4:2f:dd:f8:a5:1d:72:63:ca:52:14:a7:72:cd:a9:c9:b5:c5:16:9b:0b:d3:c4:d9
Signer

Actual PE Digest

94:99:dd:38:7b:f4:72:e5:a4:2f:dd:f8:a5:1d:72:63:ca:52:14:a7:72:cd:a9:c9:b5:c5:16:9b:0b:d3:c4:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
TlsAlloc
TlsGetValue
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetProcessTimes
GetCurrentProcess
GetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetSystemTimeAsFileTime
GetCurrentProcessId
InitializeCriticalSectionEx
GetLastError
TlsFree
IsDebuggerPresent
OutputDebugStringW
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
LocalFree
FormatMessageA
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
InitializeSListHead

advapi32

EventUnregister
EventRegister
EventWriteTransfer

ole32

CoGetMalloc

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
_Query_perf_frequency
_Query_perf_counter
?_Xbad_function_call@std@@YAXXZ

vcruntime140

__std_exception_copy
__std_type_info_destroy_list
__current_exception_context
__current_exception
__C_specific_handler
memcmp
memchr
memmove
memcpy
_purecall
memset
__std_exception_destroy
_CxxThrowException
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

free
calloc

api-ms-win-crt-runtime-l1-1-0

_cexit
terminate
_initterm
_initterm_e
_execute_onexit_table
_register_onexit_function
abort
_initialize_onexit_table
_crt_atexit
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_configure_narrow_argv
_errno
_seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

_fileno
__acrt_iob_func
__stdio_common_vsprintf_s
_get_osfhandle
fwrite
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
_setmode

api-ms-win-crt-string-l1-1-0

isalnum
isdigit
isalpha
toupper
isprint

api-ms-win-crt-math-l1-1-0

ceilf
_fpclass

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

mbsrtowcs
atoi

Exports

Exports

DxcCreateInstance
DxcCreateInstance2

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
key.txt
libgallium_wgl.dll
.dll windows x64

42425ad8b494c261810f1ed69e8d9f4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

libglapi

_glapi_get_dispatch_table_size
_glapi_get_context
_glapi_set_context
_glapi_add_dispatch
_glapi_new_nop_table
_glapi_set_nop_handler
_glapi_get_proc_address
_glapi_get_dispatch
_glapi_set_dispatch

shell32

SHFileOperationW
SHGetKnownFolderPath

ole32

CoTaskMemFree

advapi32

RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegGetValueW
OpenProcessToken
RegCloseKey

kernel32

GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileAttributesExW
OutputDebugStringW
GetFileTime
LoadLibraryA
GetFileAttributesA
CloseHandle
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
SetLastError
GetProcAddress
GetProcessTimes
GetCurrentProcess
GetSystemInfo
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
SetErrorMode
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
IsDebuggerPresent
OutputDebugStringA
GlobalMemoryStatusEx
GetConsoleWindow
GetThreadTimes
GetCurrentProcessorNumber
SetThreadAffinityMask
GetTempPathA
GetTempFileNameA
GetCommandLineA
GetModuleFileNameA
DuplicateHandle
GetLastError
TryEnterCriticalSection
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
WaitForSingleObject
SwitchToThread
GetCurrentThread
GetExitCodeThread
ResumeThread
GetThreadId
GetFileType
WriteConsoleW
FreeLibrary
LoadLibraryW
K32EnumProcessModulesEx
FlushInstructionCache
VirtualProtect
GetLargePageMinimum
GetStdHandle
CreateEventA
GetEnvironmentVariableW
FindClose
FindFirstFileW
FindNextFileW
GetLongPathNameW
TerminateProcess
GetNativeSystemInfo
GetModuleFileNameW
GetModuleHandleW
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindFirstFileExW
FlushFileBuffers
GetDiskFreeSpaceExA
GetDriveTypeW
GetFileAttributesW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetVolumePathNameW
LockFileEx
ReadFile
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
UnlockFileEx
GetSystemTime
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileExW
CreateHardLinkW
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
SearchPathW
GetExitCodeProcess
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
LocalFree
SetProcessAffinityMask
FormatMessageA
K32GetProcessMemoryInfo
RtlCaptureContext
ExpandEnvironmentStringsW
GetFullPathNameW
SetConsoleCtrlHandler
RaiseException
SetThreadPriority
GetLogicalProcessorInformationEx
GetProcessGroupAffinity
GetThreadGroupAffinity
SetThreadGroupAffinity
GetProcessAffinityMask
IsValidCodePage
GetTimeZoneInformation
GetProcessHeap
DeleteFileW
HeapQueryInformation
HeapSize
GetFileSizeEx
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
ReadConsoleW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCommandLineW
SetUnhandledExceptionFilter
GetConsoleOutputCP
WriteFile
SetEndOfFile
HeapWalk
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
GetStartupInfoW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetLocaleInfoEx
RtlPcToFileHeader
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockShared
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
SetStdHandle
SetFilePointerEx
HeapValidate

user32

SetWindowsHookExA
EnumDisplaySettingsA
LoadIconA
LoadCursorA
AdjustWindowRectEx
DestroyWindow
CreateWindowExA
RegisterClassA
DefWindowProcA
CallNextHookEx
ClientToScreen
GetWindowRect
GetClientRect
WindowFromDC
ReleaseDC
UnhookWindowsHookEx
GetDC

gdi32

DescribePixelFormat
GetPixelFormat
SetPixelFormat
StretchDIBits

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvValidateVersion
st_context_flush
st_context_teximage
st_screen_destroy
stw_create_context_attribs
stw_create_image_from_renderbuffer
stw_create_image_from_texture
stw_current_context
stw_destroy_context
stw_destroy_image
stw_framebuffer_create
stw_framebuffer_release_locked
stw_framebuffer_swap_locked
stw_framebuffer_unlock
stw_get_config_xml
stw_get_current_context
stw_get_current_dc
stw_get_device
stw_get_framebuffer_resource
stw_init_screen
stw_interop_export_object
stw_interop_flush_objects
stw_interop_query_device_info
stw_make_current
stw_override_opengl32_entry_points
stw_pbuffer_create
stw_pixelformat_choose
stw_pixelformat_get
stw_pixelformat_get_info
stw_translate_image
stw_unbind_context

Sections

.text
Size: 40.2MB - Virtual size: 40.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15.0MB - Virtual size: 15.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 516KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
libglapi.dll
.dll windows x64

b1d789e2b70106b13b701045686899ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
CloseHandle
DuplicateHandle
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
WaitForSingleObject
Sleep
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetThreadId
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
HeapSize
HeapReAlloc
ReadFile
ReadConsoleW
CreateFileW
OutputDebugStringW

Exports

Exports

_glapi_Context
_glapi_Dispatch
_glapi_add_dispatch
_glapi_check_multithread
_glapi_destroy_multithread
_glapi_get_context
_glapi_get_dispatch
_glapi_get_dispatch_table_size
_glapi_get_proc_address
_glapi_get_proc_name
_glapi_get_proc_offset
_glapi_new_nop_table
_glapi_noop_enable_warnings
_glapi_set_context
_glapi_set_dispatch
_glapi_set_nop_handler
_glapi_set_warning_func
_glthread_GetID

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
opengl32.dll
.dll windows x64

151a01d361ec2579ab63bbca849f9f41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

libgallium_wgl

DrvPresentBuffers
DrvRealizeLayerPalette
DrvSetCallbackProcs
stw_override_opengl32_entry_points
stw_pixelformat_get
stw_pixelformat_choose
stw_get_current_dc
stw_get_current_context
DrvSwapBuffers
DrvSetPixelFormat
DrvDescribePixelFormat
DrvSwapLayerBuffers
DrvGetLayerPaletteEntries
DrvSetLayerPaletteEntries
DrvDescribeLayerPlane
DrvGetProcAddress
DrvShareLists
DrvReleaseContext
DrvSetContext
DrvDeleteContext
DrvCreateLayerContext
DrvCreateContext
DrvCopyContext
DrvValidateVersion

libglapi

_glapi_get_dispatch

gdi32

GetGlyphOutlineA

kernel32

CloseHandle
CreateFileW
OutputDebugStringW
ReadConsoleW
ReadFile
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
WriteConsoleW
SetStdHandle
HeapSize
GetStringTypeW
SetConsoleCtrlHandler
GetFileType
GetStdHandle
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FlushFileBuffers
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
GetLocaleInfoW
RtlUnwind
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapReAlloc
GetCurrentThread
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW

Exports

Exports

DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvValidateVersion
glAccum
glAlphaFunc
glAreTexturesResident
glArrayElement
glBegin
glBindTexture
glBitmap
glBlendFunc
glCallList
glCallLists
glClear
glClearAccum
glClearColor
glClearDepth
glClearIndex
glClearStencil
glClipPlane
glColor3b
glColor3bv
glColor3d
glColor3dv
glColor3f
glColor3fv
glColor3i
glColor3iv
glColor3s
glColor3sv
glColor3ub
glColor3ubv
glColor3ui
glColor3uiv
glColor3us
glColor3usv
glColor4b
glColor4bv
glColor4d
glColor4dv
glColor4f
glColor4fv
glColor4i
glColor4iv
glColor4s
glColor4sv
glColor4ub
glColor4ubv
glColor4ui
glColor4uiv
glColor4us
glColor4usv
glColorMask
glColorMaterial
glColorPointer
glCopyPixels
glCopyTexImage1D
glCopyTexImage2D
glCopyTexSubImage1D
glCopyTexSubImage2D
glCullFace
glDeleteLists
glDeleteTextures
glDepthFunc
glDepthMask
glDepthRange
glDisable
glDisableClientState
glDrawArrays
glDrawBuffer
glDrawElements
glDrawPixels
glEdgeFlag
glEdgeFlagPointer
glEdgeFlagv
glEnable
glEnableClientState
glEnd
glEndList
glEvalCoord1d
glEvalCoord1dv
glEvalCoord1f
glEvalCoord1fv
glEvalCoord2d
glEvalCoord2dv
glEvalCoord2f
glEvalCoord2fv
glEvalMesh1
glEvalMesh2
glEvalPoint1
glEvalPoint2
glFeedbackBuffer
glFinish
glFlush
glFogf
glFogfv
glFogi
glFogiv
glFrontFace
glFrustum
glGenLists
glGenTextures
glGetBooleanv
glGetClipPlane
glGetDoublev
glGetError
glGetFloatv
glGetIntegerv
glGetLightfv
glGetLightiv
glGetMapdv
glGetMapfv
glGetMapiv
glGetMaterialfv
glGetMaterialiv
glGetPixelMapfv
glGetPixelMapuiv
glGetPixelMapusv
glGetPointerv
glGetPolygonStipple
glGetString
glGetTexEnvfv
glGetTexEnviv
glGetTexGendv
glGetTexGenfv
glGetTexGeniv
glGetTexImage
glGetTexLevelParameterfv
glGetTexLevelParameteriv
glGetTexParameterfv
glGetTexParameteriv
glHint
glIndexMask
glIndexPointer
glIndexd
glIndexdv
glIndexf
glIndexfv
glIndexi
glIndexiv
glIndexs
glIndexsv
glIndexub
glIndexubv
glInitNames
glInterleavedArrays
glIsEnabled
glIsList
glIsTexture
glLightModelf
glLightModelfv
glLightModeli
glLightModeliv
glLightf
glLightfv
glLighti
glLightiv
glLineStipple
glLineWidth
glListBase
glLoadIdentity
glLoadMatrixd
glLoadMatrixf
glLoadName
glLogicOp
glMap1d
glMap1f
glMap2d
glMap2f
glMapGrid1d
glMapGrid1f
glMapGrid2d
glMapGrid2f
glMaterialf
glMaterialfv
glMateriali
glMaterialiv
glMatrixMode
glMultMatrixd
glMultMatrixf
glNewList
glNormal3b
glNormal3bv
glNormal3d
glNormal3dv
glNormal3f
glNormal3fv
glNormal3i
glNormal3iv
glNormal3s
glNormal3sv
glNormalPointer
glOrtho
glPassThrough
glPixelMapfv
glPixelMapuiv
glPixelMapusv
glPixelStoref
glPixelStorei
glPixelTransferf
glPixelTransferi
glPixelZoom
glPointSize
glPolygonMode
glPolygonOffset
glPolygonStipple
glPopAttrib
glPopClientAttrib
glPopMatrix
glPopName
glPrioritizeTextures
glPushAttrib
glPushClientAttrib
glPushMatrix
glPushName
glRasterPos2d
glRasterPos2dv
glRasterPos2f
glRasterPos2fv
glRasterPos2i
glRasterPos2iv
glRasterPos2s
glRasterPos2sv
glRasterPos3d
glRasterPos3dv
glRasterPos3f
glRasterPos3fv
glRasterPos3i
glRasterPos3iv
glRasterPos3s
glRasterPos3sv
glRasterPos4d
glRasterPos4dv
glRasterPos4f
glRasterPos4fv
glRasterPos4i
glRasterPos4iv
glRasterPos4s
glRasterPos4sv
glReadBuffer
glReadPixels
glRectd
glRectdv
glRectf
glRectfv
glRecti
glRectiv
glRects
glRectsv
glRenderMode
glRotated
glRotatef
glScaled
glScalef
glScissor
glSelectBuffer
glShadeModel
glStencilFunc
glStencilMask
glStencilOp
glTexCoord1d
glTexCoord1dv
glTexCoord1f
glTexCoord1fv
glTexCoord1i
glTexCoord1iv
glTexCoord1s
glTexCoord1sv
glTexCoord2d
glTexCoord2dv
glTexCoord2f
glTexCoord2fv
glTexCoord2i
glTexCoord2iv
glTexCoord2s
glTexCoord2sv
glTexCoord3d
glTexCoord3dv
glTexCoord3f
glTexCoord3fv
glTexCoord3i
glTexCoord3iv
glTexCoord3s
glTexCoord3sv
glTexCoord4d
glTexCoord4dv
glTexCoord4f
glTexCoord4fv
glTexCoord4i
glTexCoord4iv
glTexCoord4s
glTexCoord4sv
glTexCoordPointer
glTexEnvf
glTexEnvfv
glTexEnvi
glTexEnviv
glTexGend
glTexGendv
glTexGenf
glTexGenfv
glTexGeni
glTexGeniv
glTexImage1D
glTexImage2D
glTexParameterf
glTexParameterfv
glTexParameteri
glTexParameteriv
glTexSubImage1D
glTexSubImage2D
glTranslated
glTranslatef
glVertex2d
glVertex2dv
glVertex2f
glVertex2fv
glVertex2i
glVertex2iv
glVertex2s
glVertex2sv
glVertex3d
glVertex3dv
glVertex3f
glVertex3fv
glVertex3i
glVertex3iv
glVertex3s
glVertex3sv
glVertex4d
glVertex4dv
glVertex4f
glVertex4fv
glVertex4i
glVertex4iv
glVertex4s
glVertex4sv
glVertexPointer
glViewport
wglChoosePixelFormat
wglCopyContext
wglCreateContext
wglCreateLayerContext
wglDeleteContext
wglDescribeLayerPlane
wglDescribePixelFormat
wglGetCurrentContext
wglGetCurrentDC
wglGetLayerPaletteEntries
wglGetPixelFormat
wglGetProcAddress
wglMakeCurrent
wglRealizeLayerPalette
wglSetLayerPaletteEntries
wglSetPixelFormat
wglShareLists
wglSwapBuffers
wglSwapLayerBuffers
wglSwapMultipleBuffers
wglUseFontBitmapsA
wglUseFontBitmapsW
wglUseFontOutlinesA
wglUseFontOutlinesW

Sections

.text
Size: 439KB - Virtual size: 438KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
rtx-instructions.txt
rtxloader.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

a4b371aae909065dfd71db56d9200b52

Code Sign

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cdCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

94:99:dd:38:7b:f4:72:e5:a4:2f:dd:f8:a5:1d:72:63:ca:52:14:a7:72:cd:a9:c9:b5:c5:16:9b:0b:d3:c4:d9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 212KB - Virtual size: 212KB

.data Size: 23KB - Virtual size: 31KB

.pdata Size: 42KB - Virtual size: 42KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

42425ad8b494c261810f1ed69e8d9f4b

Headers

DLL Characteristics

File Characteristics

Imports

libglapi

shell32

ole32

advapi32

kernel32

user32

gdi32

version

Exports

Exports

Sections

.text Size: 40.2MB - Virtual size: 40.2MB

.rdata Size: 15.0MB - Virtual size: 15.0MB

.data Size: 516KB - Virtual size: 1.1MB

.pdata Size: 1.9MB - Virtual size: 1.9MB

_RDATA Size: 1024B - Virtual size: 560B

.reloc Size: 215KB - Virtual size: 215KB

.rsrc Size: 1024B - Virtual size: 872B

b1d789e2b70106b13b701045686899ce

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 452KB - Virtual size: 451KB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 3KB - Virtual size: 16KB

.pdata Size: 19KB - Virtual size: 18KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 9KB - Virtual size: 9KB

.rsrc Size: 1024B - Virtual size: 832B

151a01d361ec2579ab63bbca849f9f41

Headers

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

94:99:dd:38:7b:f4:72:e5:a4:2f:dd:f8:a5:1d:72:63:ca:52:14:a7:72:cd:a9:c9:b5:c5:16:9b:0b:d3:c4:d9
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 212KB - Virtual size: 212KB

.data
Size: 23KB - Virtual size: 31KB

.pdata
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 40.2MB - Virtual size: 40.2MB

.rdata
Size: 15.0MB - Virtual size: 15.0MB

.data
Size: 516KB - Virtual size: 1.1MB

.pdata
Size: 1.9MB - Virtual size: 1.9MB

_RDATA
Size: 1024B - Virtual size: 560B

.reloc
Size: 215KB - Virtual size: 215KB

.rsrc
Size: 1024B - Virtual size: 872B

.text
Size: 452KB - Virtual size: 451KB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 3KB - Virtual size: 16KB

.pdata
Size: 19KB - Virtual size: 18KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 1024B - Virtual size: 832B

.text
Size: 439KB - Virtual size: 438KB

.rdata
Size: 101KB - Virtual size: 100KB

.data
Size: 3KB - Virtual size: 9KB

.pdata
Size: 33KB - Virtual size: 32KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 812B

UPX0
Size: - Virtual size: 3.2MB

UPX1
Size: 2.8MB - Virtual size: 2.8MB

.rsrc
Size: 5KB - Virtual size: 8KB