RTM Tool MsToLHaCkEr[.]exe

General

Target
RTM Tool MsToLHaCkEr.exe
Size 5.2MB
Sample260802-hxtansxbqa
SHA256 3c4f4ad0c697280920d5625e07ed071ccc901a5fb6242fb8b4999e056fd57e2b
MD5 7f2d5ba1eb0e863a60d7fe86bc237378
SHA1 ecdf9a770cbe3c400c6f9c5494bfb2e59c9bad05
SHA512 e58fa7f919ebed50fa82040294b4ee9afbb540b01bcec04602008fcc06e8d7e0512e52bba091ef026f0324eb988fedc552fbc91245b633ab5e3b5fb3a2f29f8e
SSDEEP 98304:yaHnF1HhptEz/eZTb9dD+Ob6S/vzejf49xGvjP0wd6gryqTmn:ysFzrEDK9dKQlQfUxGvjPILqTmn
TLSH
T12446331162D9C222C82303F40DB28B5911352D255BA8F3EBF2C2A3793D7769957727EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RTM Tool MsToLHaCkEr.exe

File Explorer

RTM Tool MsToLHaCkEr.exe

.exe 5.2MB

RTM Tool MsToLHaCkEr.exe

IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
SHA256 3c4f4ad0c697280920d5625e07ed071ccc901a5fb6242fb8b4999e056fd57e2b
MD5 7f2d5ba1eb0e863a60d7fe86bc237378
SHA1 ecdf9a770cbe3c400c6f9c5494bfb2e59c9bad05
SHA512 e58fa7f919ebed50fa82040294b4ee9afbb540b01bcec04602008fcc06e8d7e0512e52bba091ef026f0324eb988fedc552fbc91245b633ab5e3b5fb3a2f29f8e
SSDEEP 98304:yaHnF1HhptEz/eZTb9dD+Ob6S/vzejf49xGvjP0wd6gryqTmn:ysFzrEDK9dKQlQfUxGvjPILqTmn
TLSH
T12446331162D9C222C82303F40DB28B5911352D255BA8F3EBF2C2A3793D7769957727EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

52527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RaiseException GetLastError MultiByteToWideChar lstrlenA InterlockedDecrement GetProcAddress LoadLibraryA FreeResource SizeofResource LockResource LoadResource FindResourceA GetModuleHandleA Module32Next CloseHandle Module32First CreateToolhelp32Snapshot GetCurrentProcessId SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapFree GetProcessHeap HeapAlloc GetCommandLineA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA WideCharToMultiByte GetConsoleCP GetConsoleMode ReadFile TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId FlushFileBuffers SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA

ole32

OleInitialize

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayCreateVector VariantClear VariantInit SysFreeString SysAllocString

Sharing