WTRTI[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WTRTI.exe
Size

6.9MB
MD5

0bb2f1668f5a089dde83dc0a8f3b336d
SHA1

b6ffe7b2d665bc56ffba4ef407dd11742d25a0e5
SHA256

bdfcd020477fdd8ab40d5a0761f4d9ee56a130ddffd405c4e66d5b2af77cbcee
SHA512

213bfabababc3cc77bed9f849b1a0f7d3f610c8c4967cad56ddd45931fe90851d793d702252e33f58f964615a6804f4f4d863b24db925a0840f49961a587549f
SSDEEP

196608:5RI4yL7wEPBi7I6N1CKbWHNFIS6i9jUw+xVBYomfGpG:5RTcwEPBinNbWHNWXG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WTRTI.exe

Files

WTRTI.exe
.exe windows:4 windows x86 arch:x86

eac76369c0e493f8c5649a810212434b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW

comctl32

_TrackMouseEvent

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
PrintDlgA

dwmapi

DwmEnableBlurBehindWindow

gdi32

Arc
BitBlt
ChoosePixelFormat
CloseEnhMetaFile
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateEnhMetaFileA
CreateFontW
CreatePalette
CreatePen
CreatePolygonRgn
CreateRectRgn
CreateSolidBrush
DPtoLP
DeleteDC
DeleteEnhMetaFile
DeleteObject
DescribePixelFormat
EndDoc
EndPage
EnumFontFamiliesExW
EnumFontFamiliesW
EqualRgn
ExtCreatePen
ExtCreateRegion
GdiFlush
GetCharacterPlacementW
GetDCOrgEx
GetDIBits
GetDeviceCaps
GetDeviceGammaRamp
GetEnhMetaFileHeader
GetGlyphOutlineW
GetObjectA
GetRegionData
GetRgnBox
GetStockObject
GetTextExtentPoint32W
GetTextMetricsA
GetWindowOrgEx
GetWorldTransform
LPtoDP
LineTo
ModifyWorldTransform
MoveToEx
OffsetRgn
Pie
PlayEnhMetaFile
PolyPolygon
Polygon
Polyline
RealizePalette
RectInRegion
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetDIBitsToDevice
SetDeviceGammaRamp
SetGraphicsMode
SetMapMode
SetPixel
SetPixelFormat
SetStretchBltMode
SetTextAlign
SetTextColor
SetViewportExtEx
SetWindowExtEx
SetWindowOrgEx
SetWorldTransform
StartDocA
StartPage
StretchBlt
StretchDIBits
SwapBuffers
TextOutW
UpdateColors

gdiplus

GdipAddPathLine2
GdipAddPathLine2I
GdipAddPathLineI
GdipAddPathPolygonI
GdipAlloc
GdipCloneBrush
GdipClosePathFigure
GdipCreateFromHDC
GdipCreatePath
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipDeleteGraphics
GdipDeletePath
GdipDeletePen
GdipDrawArcI
GdipDrawLineI
GdipDrawPath
GdipFillPath
GdipFillPieI
GdipFree
GdipGetPenWidth
GdipScaleWorldTransform
GdipSetPenColor
GdipSetPenDashArray
GdipSetPenDashStyle
GdipSetPenEndCap
GdipSetPenLineJoin
GdipSetPenStartCap
GdipSetPenWidth
GdipSetSmoothingMode
GdipSetSolidFillColor
GdiplusShutdown
GdiplusStartup

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AttachConsole
CloseHandle
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerW
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FormatMessageW
FreeConsole
FreeLibrary
GetACP
GetCommandLineW
GetComputerNameA
GetConsoleWindow
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetFileAttributesA
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDrives
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessAffinityMask
GetProcessTimes
GetQueuedCompletionStatusEx
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount64
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVolumeInformationW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
InitOnceExecuteOnce
InitializeCriticalSection
InitializeSRWLock
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MulDiv
MultiByteToWideChar
OpenFileMappingW
OpenProcess
OutputDebugStringA
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ReplaceFileW
ResetEvent
ResumeThread
RtlUnwind
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFileAttributesW
SetFileCompletionNotificationModes
SetFilePointer
SetFileTime
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadExecutionState
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
VerSetConditionMask
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpA
lstrlenW

msvcrt

__DestructExceptionObject
__getmainargs
__initenv
__mb_cur_max
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_assert
_beginthread
_beginthreadex
_cexit
_close
_endthreadex
_errno
_filelengthi64
_fileno
_findclose
_fstat64
_get_osfhandle
_initterm
_iob
_isctype
_lock
_lseeki64
_onexit
_pclose
_popen
_setjmp3
_stati64
_wstat64
fwprintf
_strdup
_stricmp
_strnicmp
_strtoui64
_telli64
_ultoa
_unlock
_vsnprintf
_waccess
_wchdir
_wchmod
_wcsicmp
_wcsnicmp
_wexecl
_wexecvp
_wfopen
_wfopen_s
_wfsopen
_wfullpath
_wgetcwd
_wgetenv
_wmkdir
_wopen
_wputenv
_wrename
_wrmdir
_wsystem
_wunlink
abort
acos
asin
atan
atof
atoi
atol
bsearch
calloc
clearerr
clock
cosh
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fputwc
fread
free
freopen
fseek
fsetpos
ftell
fwrite
getc
getenv
getwc
isalnum
isalpha
islower
isprint
isspace
isupper
iswctype
isxdigit
localeconv
log10
longjmp
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
mktime
localtime
gmtime
difftime
perror
printf
putc
putchar
putwc
qsort
raise
rand
realloc
remove
rename
setlocale
setvbuf
signal
sinh
srand
strcat
strchr
strcmp
strcoll
strcpy
strcpy_s
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strncpy_s
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
strxfrm
system
tan
tanh
tmpfile
tmpnam
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
time
wcscat
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncpy
wcstombs
wcsxfrm
_wutime
_wstat
_wfindnext
_wfindfirst
_strtoui64
_strtoi64
_stat
_ftime
_atoi64
_vsnprintf_s
_write
_strnicmp
_stricmp
_strdup
_rmdir
_read
_mkdir
_getcwd
_fileno
_fdopen
_access

ole32

CoCreateInstance
CoInitialize
CoInitializeEx
CoUninitialize
DoDragDrop
OleInitialize
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop

opengl32

wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent

shell32

CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
SHBrowseForFolderW
SHCreateItemFromParsingName
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListA
SHGetPathFromIDListW
ShellExecuteA
ShellExecuteW
Shell_NotifyIconW

user32

AdjustWindowRectEx
BringWindowToTop
CallWindowProcA
CallWindowProcW
ChangeClipboardChain
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CopyIcon
CreateIconIndirect
CreatePopupMenu
CreateWindowExA
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyIcon
DestroyWindow
DispatchMessageW
EmptyClipboard
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsExW
EnumDisplaySettingsW
FillRect
FindWindowA
FindWindowW
FlashWindow
GetActiveWindow
GetAsyncKeyState
GetClassLongW
GetClassNameW
GetClientRect
GetClipboardData
GetClipboardOwner
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetLayeredWindowAttributes
GetMessageTime
GetMonitorInfoW
GetParent
GetPropW
GetRawInputData
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetSysColor
GetSystemMetrics
GetUpdateRgn
GetWindow
GetWindowLongA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowThreadProcessId
InsertMenuW
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsWindow
IsWindowVisible
IsZoomed
LoadCursorA
LoadCursorW
LoadIconA
LoadIconW
LoadImageW
MapVirtualKeyW
MapWindowPoints
MessageBeep
MessageBoxA
MessageBoxW
MonitorFromWindow
MoveWindow
MsgWaitForMultipleObjects
OffsetRect
OpenClipboard
OpenIcon
PeekMessageA
PeekMessageW
PostMessageA
PostMessageW
PostThreadMessageA
PtInRect
RegisterClassA
RegisterClassExW
RegisterDeviceNotificationW
RegisterRawInputDevices
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageTimeoutW
SendMessageW
SetActiveWindow
SetCapture
SetClipboardData
SetClipboardViewer
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetPropW
SetRect
SetWindowLongA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextW
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicode
TrackMouseEvent
TrackPopupMenu
TranslateMessage
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
ValidateRgn
WaitMessage
WindowFromPoint

winmm

timeBeginPeriod
timeEndPeriod

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntop
inet_pton
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 330KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 667KB - Virtual size: 667KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 896KB - Virtual size: 895KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eac76369c0e493f8c5649a810212434b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

comdlg32

dwmapi

gdi32

gdiplus

kernel32

msvcrt

ole32

opengl32

shell32

user32

winmm

ws2_32

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.data Size: 330KB - Virtual size: 329KB

.rdata Size: 667KB - Virtual size: 667KB

.eh_fram Size: 896KB - Virtual size: 895KB

.bss Size: - Virtual size: 63KB

.idata Size: 19KB - Virtual size: 18KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 167KB - Virtual size: 166KB

.text
Size: 4.8MB - Virtual size: 4.8MB

.data
Size: 330KB - Virtual size: 329KB

.rdata
Size: 667KB - Virtual size: 667KB

.eh_fram
Size: 896KB - Virtual size: 895KB

.bss
Size: - Virtual size: 63KB

.idata
Size: 19KB - Virtual size: 18KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 167KB - Virtual size: 166KB