drttransport.pdb
Static task
static1
Behavioral task
behavioral1
Sample
drttransport.dll
Resource
win10v2004-20240508-en
General
-
Target
drttransport.dll
-
Size
42KB
-
MD5
8d83e58266ee73a887a13d37a9d56978
-
SHA1
5813995bb80383cf7c2ed68b0f3a8996c53d227f
-
SHA256
f903bb0ac54eb35d79f804ea7c5eedbc522e387fb916fd4d9231c3a9c1da84c2
-
SHA512
d22a56fdfe5d2fdbeea0739d1eefa0c5d2036de9df7b4bdc05e1b927bf04fae0eea9363a211a34e33b2665812045e9824ce298ee5b9b529d1d2f00e683616dbf
-
SSDEEP
768:/PTXl2gH7y7EbmhGGjAB1gwdpN+Ib7sc:J2Iy7mYkB1X6Ib
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource drttransport.dll
Files
-
drttransport.dll.dll windows:10 windows x86 arch:x86
21d5af07e440b25aeafe25142cb50144
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
qsort
memcmp
memmove
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
__CxxFrameHandler3
memset
ntdll
EtwEventUnregister
EtwEventActivityIdControl
EtwEventWriteTransfer
EtwUnregisterTraceGuids
EtwEventRegister
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
kernel32
GetProcessHeap
CreateFileW
DeviceIoControl
CreateTimerQueue
DebugBreak
CreateThreadpoolCleanupGroup
HeapAlloc
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
CancelThreadpoolIo
DeleteTimerQueueEx
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetLastError
LeaveCriticalSection
CreateThreadpoolIo
StartThreadpoolIo
HeapFree
DeleteCriticalSection
ResetEvent
CloseHandle
SetEvent
CreateEventW
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
HeapReAlloc
cryptbase
SystemFunction036
Exports
Exports
DrtCreateIpv6UdpTransport
DrtDeleteIpv6UdpTransport
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ