rtcall[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rtcall.exe
Size

7.5MB
MD5

9afc1f776338290871fc3533e2cfdfce
SHA1

caf7954c5b4f4c43ad8f9871a818b571e4baa0da
SHA256

850f81f6a774f49ab79377143f17686ab079074cea48f03753ae53372aea5cc1
SHA512

8ad018b4a4f4ff15ecb3a02a303c6ea701ac1ad670fee75071242d5e9a7a6f1c7b8615ff677576bdca3e3d61ae5505d75c1d9a30379ccfe55ce05eff18216dfb
SSDEEP

98304:vzk8D1GtVYvpofkMUPdiWCYPkvRExHpC/RR05vTYL02cm2Jr:bbMoCFa9s/n5Am8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rtcall.exe

Files

rtcall.exe
.exe windows:4 windows x64

69f475bf72c03a9193fdd6f178531f72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libgio-2.0-0

g_networking_init

libglib-2.0-0

g_free
g_main_loop_get_context
g_main_loop_new
g_main_loop_quit
g_main_loop_run
g_main_loop_unref
g_malloc
g_malloc0
g_slist_free
g_slist_free_full
g_slist_length
g_slist_nth
g_snprintf
g_strdup
g_strfreev
g_strsplit
g_thread_join
g_thread_new
g_thread_try_new

libgobject-2.0-0

g_object_set
g_object_unref
g_signal_connect_data

libnice-10

nice_address_get_port
nice_address_to_string
nice_agent_add_stream
nice_agent_attach_recv
nice_agent_gather_candidates
nice_agent_get_local_candidates
nice_agent_get_local_credentials
nice_agent_new
nice_agent_parse_remote_stream_sdp
nice_agent_send
nice_agent_set_relay_info
nice_agent_set_remote_candidates
nice_agent_set_remote_credentials
nice_agent_set_stream_name
nice_candidate_free

libcrypto-1_1-x64

BIO_ctrl
BIO_get_data
BIO_meth_new
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_write
BIO_new
BIO_new_mem_buf
BIO_s_mem
BIO_set_data
BIO_set_init
BIO_set_shutdown
BIO_write
BN_CTX_free
BN_CTX_new
BN_bin2bn
BN_bn2bin
BN_cmp
BN_copy
BN_free
BN_hex2bn
BN_mod_exp
BN_new
BN_num_bits
BN_set_word
BN_sub_word
BN_value_one
DH_compute_key
DH_free
DH_generate_key
DH_new
EC_KEY_free
EC_KEY_new_by_curve_name
EVP_PKEY_assign
EVP_PKEY_free
EVP_PKEY_new
EVP_sha1
EVP_sha256
HMAC_CTX_new
HMAC_Final
HMAC_Init_ex
HMAC_Update
PEM_read_bio_RSAPrivateKey
PEM_read_bio_RSA_PUBKEY
RC4_set_key
RSA_free
RSA_generate_key_ex
RSA_new
RSA_private_decrypt
RSA_private_encrypt
RSA_public_decrypt
RSA_public_encrypt
X509_NAME_add_entry_by_txt
X509_STORE_CTX_get_error
X509_digest
X509_free
X509_get_subject_name
X509_getm_notAfter
X509_getm_notBefore
X509_gmtime_adj
X509_new
X509_set_issuer_name
X509_set_pubkey
X509_set_version
X509_sign

libssl-1_1-x64

DTLS_method
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_new
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_certificate
SSL_ctrl
SSL_do_handshake
SSL_export_keying_material
SSL_free
SSL_is_init_finished
SSL_new
SSL_read
SSL_set_accept_state
SSL_set_bio
SSL_set_options

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

comdlg32

GetOpenFileNameA

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
GetObjectA
GetStockObject
SelectObject
StretchBlt

kernel32

CloseHandle
CopyFileA
CreateEventA
CreateEventW
CreateFileA
CreateProcessA
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerA
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommState
GetCommTimeouts
GetCommandLineA
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetWindowsDirectoryA
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
ResetEvent
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCommState
SetCommTimeouts
SetConsoleTextAttribute
SetEvent
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SetupComm
Sleep
TerminateProcess
TerminateThread
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrlenA

msvcrt

__C_specific_handler
___lc_codepage_func
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_errno
_exit
_filelengthi64
_fileno
_fmode
_fstat64
_ftime64
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_mktime64
_onexit
_sopen
_stricmp
_strnicmp
_time64
_unlock
_vsnprintf
_wfopen
_wrename
_write
_wsopen
_wunlink
abort
acos
asin
atan
atof
atoi
atol
bsearch
calloc
clock
cosh
exit
fclose
feof
ferror
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
frexp
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
islower
isspace
isupper
isxdigit
localeconv
log10
malloc
memcmp
memcpy
memmove
memset
printf
puts
qsort
raise
rand
realloc
remove
signal
sinh
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcpy_s
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
system
tan
tanh
tolower
ungetc
vfprintf
wcscpy
wcslen
_snwprintf
_write
_strdup
_read
_open
_lseek
_isatty
_fileno
_close
_access

libwinpthread-1

clock_gettime
sem_destroy
sem_init
sem_post
sem_timedwait
sem_wait

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
Shell_NotifyIconA

user32

AppendMenuA
CharLowerBuffA
ClientToScreen
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyMenu
DestroyWindow
DialogBoxParamA
DispatchMessageA
EndDialog
FindWindowA
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItemInt
GetDlgItemTextA
GetMessageA
GetWindowRect
IsWindowVisible
KillTimer
LoadCursorA
LoadIconA
MessageBoxA
MessageBoxW
PostMessageA
PostQuitMessage
PtInRect
RegisterClassA
RegisterClassExA
RegisterHotKey
ReleaseCapture
SendDlgItemMessageA
SetCapture
SetCursor
SetDlgItemInt
SetDlgItemTextA
SetForegroundWindow
SetMenuDefaultItem
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
TrackPopupMenu
TranslateMessage
UnregisterHotKey
wsprintfA

winmm

timeBeginPeriod
waveInAddBuffer
waveInClose
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInUnprepareHeader

ws2_32

WSAGetLastError
WSASetLastError
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getservbyname
getservbyport
htonl
htons
inet_addr
inet_ntoa
inet_ntop
inet_pton
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

sdl2

SDL_CloseAudio
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateWindow
SDL_CreateWindowFrom
SDL_DestroyWindow
SDL_FillRect
SDL_FreeSurface
SDL_GetWindowSize
SDL_GetWindowSurface
SDL_Init
SDL_OpenAudio
SDL_PauseAudio
SDL_QueueAudio
SDL_Quit
SDL_SetColorKey
SDL_SetHint
SDL_SetSurfaceBlendMode
SDL_UpdateWindowSurface
SDL_UpperBlitScaled
SDL_WaitEventTimeout

Exports

Exports

debugClear
debugGetInfo
debugPrintf
faacEncClose
faacEncEncode
faacEncGetCurrentConfiguration
faacEncGetDecoderSpecificInfo
faacEncGetVersion
faacEncOpen
faacEncSetConfiguration
libaskyProtocolQuit
libaskyProtocolStart
read_JPEG_file
rtcallAccept
rtcallBuildFullname
rtcallConnect
rtcallDisable
rtcallDisconnect
rtcallEnable
rtcallGetOwner
rtcallGetType
rtcallIsConnected
rtcallIsEnabled
rtcallSetAddr
rtcallSetAttr
sdlCreate
sdlDestroy
sdlDraw
sdlFlip
sdlInit
sdlPlayAudio
sdlUnInit
uicoreInit
uicoreUninit
write_JPEG_file

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 754KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 57.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 925B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69f475bf72c03a9193fdd6f178531f72

Headers

DLL Characteristics

File Characteristics

Imports

libgio-2.0-0

libglib-2.0-0

libgobject-2.0-0

libnice-10

libcrypto-1_1-x64

libssl-1_1-x64

advapi32

comdlg32

gdi32

kernel32

msvcrt

libwinpthread-1

shell32

user32

winmm

ws2_32

sdl2

Exports

Exports

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.data Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 754KB - Virtual size: 754KB

.rodata Size: 2KB - Virtual size: 1KB

.pdata Size: 91KB - Virtual size: 91KB

.xdata Size: 104KB - Virtual size: 103KB

.bss Size: - Virtual size: 57.0MB

.edata Size: 1024B - Virtual size: 925B

.idata Size: 17KB - Virtual size: 17KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 104B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 4.5MB - Virtual size: 4.5MB

.data
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 754KB - Virtual size: 754KB

.rodata
Size: 2KB - Virtual size: 1KB

.pdata
Size: 91KB - Virtual size: 91KB

.xdata
Size: 104KB - Virtual size: 103KB

.bss
Size: - Virtual size: 57.0MB

.edata
Size: 1024B - Virtual size: 925B

.idata
Size: 17KB - Virtual size: 17KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 13KB - Virtual size: 13KB