RTWorkQ[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RTWorkQ.dll
Size

148KB
MD5

5bc2d871eb445a70eb762ece7c574bbd
SHA1

afe34470814e6ac5b2f93737be79ff4b21fdc7e9
SHA256

0d146c5ddfb829a989c442e5e0781120fe925ace5468fdd9c350e75138d61a2d
SHA512

f687cee1f102c6aac7d5d7377ac500869ba89ce6b05c0190441cb72ce74274c231250b99356597688b6f0e9494ecae8ec6c69a95d5df025cf488e915de7ee184
SSDEEP

3072:Hlgw2ru/qzWEbZIAJqfPcb9uJMPjXZQ6aYNFzVgkB5D/hB/lIVU+PsDcV:Hiw+uSpbWAJ6Pcb9ujPYNNHDJfQ3V

Score

1^/10

Malware Config

Signatures

Files

RTWorkQ.dll
.dll windows:10 windows x86 arch:x86

b9ace3267dc6bd5d96efea5a8e066d95

Code Sign

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2016, 20:39

Not After

11/01/2018, 20:39

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:19:00:b4:01:d8:9c:b8:6b:c0:b7:4d:28:4f:7d:76:2d:5d:f3:19:38:01:dc:61:97:99:1e:96:71:7f:30:f6
Signer

Actual PE Digest

54:19:00:b4:01:d8:9c:b8:6b:c0:b7:4d:28:4f:7d:76:2d:5d:f3:19:38:01:dc:61:97:99:1e:96:71:7f:30:f6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rtworkq.pdb

Imports

msvcrt

_XcptFilter
memcpy
_amsg_exit
memcmp
_onexit
__dllonexit
_initterm
_unlock
_lock
_callnewh
_wcsnicmp
memmove
malloc
free
_purecall
srand
wcsncmp
_beginthreadex
_except_handler4_common
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventUnregister

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel

api-ms-win-core-synch-l1-2-0

ResetEvent
CancelWaitableTimer
WaitForSingleObject
InitializeSRWLock
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
ReleaseSemaphore
CreateWaitableTimerExW
SetEvent
Sleep

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId
GetCurrentThread
TlsFree
GetCurrentProcess
TlsAlloc
GetCurrentProcessId
TerminateProcess
TlsSetValue
TlsGetValue

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-com-l1-1-1

CoUninitialize
CoIncrementMTAUsage
CoDecrementMTAUsage
CoInitializeEx
CoTaskMemFree
CoGetApartmentType

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CloseThreadpoolWork
CloseThreadpool
CloseThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
SubmitThreadpoolWork
CreateThreadpool
CancelThreadpoolIo
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolTimer
CreateThreadpoolIo
CloseThreadpoolIo
StartThreadpoolIo

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount
GetOsSafeBootMode

ntdll

NtSetTimerEx
TpSetPoolThreadBasePriority
TpSetPoolWorkerThreadIdleTimeout
NtSetInformationThread
RtlEqualWnfChangeStamps
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-fibers-l1-1-1

FlsSetValue
FlsFree
FlsAlloc

api-ms-win-core-com-private-l1-1-0

CoRegisterInitializeSpy
CoRevokeInitializeSpy

api-ms-win-mm-time-l1-1-0

timeBeginPeriod
timeEndPeriod

api-ms-win-core-debug-l1-1-1

DebugBreak

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-io-l1-1-1

CreateIoCompletionPort

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

RtwqAddPeriodicCallback
RtwqAllocateSerialWorkQueue
RtwqAllocateWorkQueue
RtwqBeginRegisterWorkQueueWithMMCSS
RtwqBeginUnregisterWorkQueueWithMMCSS
RtwqCancelDeadline
RtwqCancelWorkItem
RtwqCreateAsyncResult
RtwqEndRegisterWorkQueueWithMMCSS
RtwqEndUnregisterWorkQueueWithMMCSS
RtwqGetPlatform
RtwqGetWorkQueueMMCSSClass
RtwqGetWorkQueueMMCSSPriority
RtwqGetWorkQueueMMCSSTaskId
RtwqInvokeCallback
RtwqJoinWorkQueue
RtwqLockPlatform
RtwqLockSharedWorkQueue
RtwqLockWorkQueue
RtwqPutWaitingWorkItem
RtwqPutWorkItem
RtwqRegisterPlatformEvents
RtwqRegisterPlatformWithMMCSS
RtwqRemovePeriodicCallback
RtwqScheduleWorkItem
RtwqSetDeadline
RtwqSetDeadline2
RtwqSetLongRunning
RtwqShutdown
RtwqStartup
RtwqUnjoinWorkQueue
RtwqUnlockPlatform
RtwqUnlockWorkQueue
RtwqUnregisterPlatformEvents
RtwqUnregisterPlatformFromMMCSS

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9ace3267dc6bd5d96efea5a8e066d95

Code Sign

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

54:19:00:b4:01:d8:9c:b8:6b:c0:b7:4d:28:4f:7d:76:2d:5d:f3:19:38:01:dc:61:97:99:1e:96:71:7f:30:f6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-heap-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

ntdll

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-com-private-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 104KB

.data Size: 512B - Virtual size: 10KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 60B

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 7KB - Virtual size: 7KB

33:00:00:01:06:6e:c3:25:c4:31:c9:18:0e:00:00:00:00:01:06
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

54:19:00:b4:01:d8:9c:b8:6b:c0:b7:4d:28:4f:7d:76:2d:5d:f3:19:38:01:dc:61:97:99:1e:96:71:7f:30:f6
Signer

.text
Size: 104KB - Virtual size: 104KB

.data
Size: 512B - Virtual size: 10KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 60B

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 7KB - Virtual size: 7KB