Static task
static1
Behavioral task
behavioral1
Sample
05_RTL.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
05_RTL.exe
Resource
win10v2004-20230915-en
General
-
Target
05_RTL.exe
-
Size
44KB
-
MD5
3b94be1ffe65b25c11fa0ca4925a1b6b
-
SHA1
f8df59f5c8035bffe7073dd1f2dab79e2780f4a8
-
SHA256
666aa148cd1d569aa2a6b3abf05317b3508ce09465c023d041c257b352cdfba7
-
SHA512
f95b64d14e73098f455146c8f36b5cbe2ab50331dcc1c0baf1e63a6a6b46dc28ccfaefd258766a55d9beb7f9a3c1da5cc7c121143c87325b11efb9beb7ffa1d5
-
SSDEEP
384:xwtxbQAcT5mx9FLLQET+jFTpR8blyrPI8O82hnS2Gy+9+jYaRBOWxgIMcD/mm:xAjPLLB+hToZyh72hnSzTaR15McDd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05_RTL.exe
Files
-
05_RTL.exe.exe windows:4 windows x86
c2cc414565a48889da2ff227fa52e412
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleHandleA
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
GetLastError
GetFileAttributesA
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessA
SetFilePointer
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
HeapSize
CompareStringA
MultiByteToWideChar
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
CreateFileA
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE