RdmsInst[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RdmsInst.dll
Size

20KB
MD5

28136e4a54f399d94ff06994dab2f3db
SHA1

71ee67d73d03d4d97d3695067cca29469030dd3b
SHA256

695c079818110f7b5ad08806784a2c8b58a6c52edb047587bc85575b3d8bca84
SHA512

342e9d2625ffa3782750678b8e9b7d828ad54abd56e37e19c559fbc0754955a3a9d6c1d90e498721b61467023d8483e306c2bbe00db01043c1abb251be426cdc
SSDEEP

192:6m13SsLWPpV9TWJfUO3cOY532KMnT1TDr19jeHlxtMvD9/HTzPtfrzutOO1GyW42:6mFSsWPLZWKXuDyYpPMCY+3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RdmsInst.dll

Files

RdmsInst.dll
.dll windows:10 windows x86 arch:x86

d5ba580f2b975a270d4fd13e7c4c2300

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

RdmsInst.pdb

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
DisableThreadLibraryCalls

Sections

.text
Size: 1024B - Virtual size: 789B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ