devrtl[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

devrtl.dll
Size

43KB
MD5

fd07f21e0a19c27ed4e1eec2b07452b3
SHA1

f235f045cc4a53daf90a48ede2f384fff1289ade
SHA256

df54c00b021af64bb04edebca6f41ccf48f1959dd53ade545fafc565f1243392
SHA512

d79c3d36d73c9971a3f4351e09a40bad79cbedb690cde8c003d856a041f31cd5f815aa9f53f411d2e980127fcd51e054a84b1be30350c5832512f99e3656b2ae
SSDEEP

768:gRk+wCfGIR84N0G3VeTFjZ0aG3i5Bn18Btpig8s3vqQiaZzwzGjtM5gTK/nmq56:gRkz+W4N0GKF8i5Bn1M78nQiaFwzOtdI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
devrtl.dll

Files

devrtl.dll
.dll windows:6 windows x86 arch:x86

0d636a41c626879514a853a5e7e043f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

devrtl.pdb

Imports

msvcrt

free
malloc
memcpy
_vsnwprintf
_initterm
toupper
_vsnprintf
wcsrchr
memmove
_resetstkoflw
_wcsicmp
_amsg_exit
_except_handler4_common
memset
wcschr
_XcptFilter

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-misc-l1-1-0

lstrlenW
Sleep
LocalFree
LocalAlloc
FormatMessageW
lstrcmpW
lstrlenA

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
TlsGetValue
TlsAlloc
TlsFree
GetCurrentProcess
TlsSetValue

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW

ntdll

NtQueryInformationFile
NtSetInformationFile
NtQuerySystemInformation
RtlMultiByteToUnicodeSize
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteSize
RtlNtStatusToDosError
RtlUnicodeToMultiByteN

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
WriteFile
CreateFileW
FlushFileBuffers
DeleteFileW
SetFilePointer
GetFileSize
GetFileInformationByHandle
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW
SetEndOfFile
FileTimeToSystemTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-0

GetProcAddress
GetModuleFileNameA
LoadLibraryExW

api-ms-win-core-localization-l1-1-0

GetThreadLocale
LCMapStringW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
CreateFileMappingW
UnmapViewOfFile

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

CreateEventW
SetEvent
WaitForSingleObjectEx

kernel32

CreateHardLinkW
GetCommandLineA
MoveFileExW
MoveFileW

Exports

Exports

DevRtlCloseTextLogSection
DevRtlCreateTextLogSectionA
DevRtlCreateTextLogSectionW
DevRtlGetThreadLogToken
DevRtlSetThreadLogToken
DevRtlWriteTextLog
DevRtlWriteTextLogError
NdxTableAddObject
NdxTableAddObjectToList
NdxTableClose
NdxTableFirstObject
NdxTableFirstObjectInList
NdxTableGetObjectName
NdxTableGetObjectType
NdxTableGetObjectTypeCount
NdxTableGetObjectTypeName
NdxTableGetPropertyTypeClass
NdxTableGetPropertyTypeCount
NdxTableGetPropertyTypeName
NdxTableGetPropertyValue
NdxTableNextObject
NdxTableObjectFromName
NdxTableObjectFromPointer
NdxTableOpen
NdxTableRemoveObject
NdxTableRemoveObjectFromList
NdxTableSetObjectPointer
NdxTableSetPropertyValue
NdxTableSetTypeDefinition

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d636a41c626879514a853a5e7e043f8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localization-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 37KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 38KB - Virtual size: 37KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB