rt3ret3(3)[.]exe | Triage

Sharing

General

Target

rt3ret3(3).exe
Size

236KB
MD5

efa4b2e7d7016a1f80efff5840de3a18
SHA1

04606786daa6313867c7ada1f0c9c925d9b602fb
SHA256

291c573996c647508544e8e21bd2764e6e4c834d53d6d2c8903a0001c783764b
SHA512

11446166922efb329d547ce329fb3ed70a3a99c1c037533beaecefd16d4a67c9dc9201592b0428a06fd956e4bb5caf3f7997a86200792e3e29a041f0963b2ced
SSDEEP

6144:NgsO6Xkm0RsQNCR/JG+z5nLGcKYp05dMgSsXMH7/wrtKHRAwrcKxN:7GRsQ6RLhLGO05dMgrXwTKtKxA5w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

rt3ret3(3).exe

Files

rt3ret3(3).exe
.exe windows:6 windows x64 arch:x64

787151c6bef6ee11d1d73736521d9ba7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

DlgDirListComboBoxW
LoadImageA
LoadBitmapA
GetWindow
GetUpdateRect
IsWindowVisible

gdi32

CreateEllipticRgnIndirect
DrawEscape
CreateEllipticRgn
CreateCompatibleBitmap
CombineRgn
AbortPath
EndDoc

shlwapi

StrToIntA
StrRChrA
StrCmpIW
StrPBrkA

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE