e:\po\trunk\modules\rtfile\Release\rtfile32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a0768a4dd9ab0f567e3095a691c9adda90cf3ff8783b3b580f99a28c6605baad.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a0768a4dd9ab0f567e3095a691c9adda90cf3ff8783b3b580f99a28c6605baad.dll
Resource
win10v2004-20240802-en
General
-
Target
a0768a4dd9ab0f567e3095a691c9adda90cf3ff8783b3b580f99a28c6605baad
-
Size
360KB
-
MD5
12af2317943ed8455f0df2fcdb1a48d9
-
SHA1
6b7b9522d1aa2ebe610d6d0789ff86e2a8bbac34
-
SHA256
a0768a4dd9ab0f567e3095a691c9adda90cf3ff8783b3b580f99a28c6605baad
-
SHA512
bfd182a8e809e46cdea933b90dab20950892de77563c24653ff7679954d51729cec1b3ccb71fc4e2a4b228183b9a12ac5558fdf3f97ba1375941d15c43efc39e
-
SSDEEP
6144:v7Dlh/MTtGKyTu9Ag4GykrBeaK1zZmN/UjsGeJwDJGbr83/z2gEeor402U:v7D/qtGKQu9Ag4HaAzZmN/UjsGeJ8G3H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0768a4dd9ab0f567e3095a691c9adda90cf3ff8783b3b580f99a28c6605baad
Files
-
a0768a4dd9ab0f567e3095a691c9adda90cf3ff8783b3b580f99a28c6605baad.dll windows:5 windows x86 arch:x86
fdc113925be593e7c108aecaf07149fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateThread
GetVolumeInformationW
FileTimeToLocalFileTime
GetWindowsDirectoryW
CloseHandle
GetCurrentThreadId
GetFileAttributesExW
GetModuleHandleA
lstrcmpiW
CreateEventW
LoadLibraryA
ResetEvent
EnterCriticalSection
GetProcAddress
FileTimeToSystemTime
lstrcpynW
LeaveCriticalSection
InitializeCriticalSection
GetLogicalDrives
SetEvent
WaitForSingleObject
GetFileSize
SetFilePointer
GetFileTime
SetFileTime
OutputDebugStringW
MoveFileExW
SetFileAttributesW
LocalFree
Module32NextW
OpenEventW
GetDriveTypeW
DisableThreadLibraryCalls
lstrcmpA
DeleteFileW
lstrcatW
GetLastError
GetFileAttributesW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetModuleFileNameW
lstrlenW
lstrcpyW
lstrcpyA
GetTempFileNameW
CreateFileA
FindFirstFileW
VirtualQuery
lstrcpynA
SetEndOfFile
GetDriveTypeA
OpenProcess
LoadLibraryW
FormatMessageW
ReadFile
CreateFileW
lstrcmpW
GetTempPathW
GetCurrentDirectoryW
FindClose
GetLocalTime
Process32FirstW
ProcessIdToSessionId
RemoveDirectoryW
DeviceIoControl
Module32FirstW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
WriteConsoleW
advapi32
RegOpenKeyExW
RegCloseKey
RegSetValueExW
GetUserNameW
OpenProcessToken
RegCreateKeyExW
CreateProcessAsUserW
ImpersonateLoggedOnUser
RevertToSelf
RegEnumValueW
shell32
SHGetSpecialFolderPathW
ord165
shlwapi
PathFindExtensionW
PathFileExistsW
PathIsDirectoryW
SHGetValueA
PathRemoveBackslashW
PathFindFileNameW
StrStrIW
StrChrW
SHGetValueW
PathAppendW
SHSetValueW
StrChrA
wnsprintfW
wvnsprintfA
wvnsprintfW
wnsprintfA
StrNCatW
PathRemoveFileSpecW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
ole32
CoCreateGuid
CoInitialize
CoCreateInstance
Sections
.text Size: 271KB - Virtual size: 271KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ