wfreerdp[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

wfreerdp.exe
Size

4.1MB
MD5

f40fb33d77404db6ff1d33e15eedb88a
SHA1

dc02a0b02d497a0f8dc426900e8e4134f45b9427
SHA256

3f5449dc1eeecc06d279ec2b8d1fdc62aa0ef676424a3f8b38b686d54d6bb8e0
SHA512

d53a4dd5cdf6de873ab13c5c98bc49bf513f08af02a0dcaee3eea5b1f70462ab4306c5f879c9902bb2f730aa879d1de7c158329246a4c898c5cf47d4991380ad
SSDEEP

49152:5qpPdAHUPkiuxnv49uWF6c8JrnL8GWr2M8IWp15WyDPH/Ipp8AzgXUxgmmC1fD:8lO5gu/dAqrD//wLxg61fD

Score

1^/10

Malware Config

Signatures

Files

wfreerdp.exe
.exe windows x64

4d3b7819d2099b7489e93b967c262426

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msimg32

GradientFill
AlphaBlend

credui

CredUIParseUserNameA
CredUIPromptForCredentialsA
CredUICmdLinePromptForCredentialsA

ntdll

RtlCaptureStackBackTrace
RtlUnwindEx
RtlCaptureContext
RtlNtStatusToDosError
NtWaitForSingleObject
NtDeviceIoControlFile
RtlVirtualUnwind
RtlLookupFunctionEntry

crypt32

CertFreeCertificateChainEngine
CertCreateCertificateContext
CryptStringToBinaryA
CertFreeCertificateChain
CertFreeCertificateContext
CertCreateCertificateChainEngine
CertVerifyCertificateChainPolicy
CertGetCertificateChain

ncrypt

NCryptOpenStorageProvider
NCryptGetProperty
NCryptEnumStorageProviders
NCryptFreeObject
NCryptOpenKey
NCryptFreeBuffer
NCryptEnumKeys

dbghelp

SymGetLineFromAddr64
SymInitialize
SymFromAddr

rpcrt4

RpcStringFreeA
UuidEqual
UuidToStringA
UuidCreate

shlwapi

PathFileExistsW
PathIsRelativeA
PathIsDirectoryEmptyW

libssl-1_1-x64

SSL_CTX_use_RSAPrivateKey_file
SSL_use_certificate_file
SSL_accept
OPENSSL_init_ssl
SSL_get_rbio
SSL_get_peer_cert_chain
SSL_ctrl
SSL_clear
TLS_client_method
SSL_set_bio
SSL_set_accept_state
SSL_use_certificate
SSL_get_wbio
SSL_set_connect_state
SSL_CTX_set_options
SSL_read
SSL_CTX_free
SSL_free
SSL_write
SSL_CTX_new
SSL_set_info_callback
SSL_CTX_set_security_level
SSL_shutdown
SSL_get_info_callback
SSL_use_PrivateKey
SSL_pending
SSL_get_certificate
SSL_new
SSL_do_handshake
SSL_get_error
TLS_server_method
SSL_get_peer_certificate
SSL_in_init
SSL_CTX_ctrl
SSL_CTX_set_keylog_callback
SSL_alert_type_string_long
SSL_alert_desc_string_long
SSL_set_ex_data
SSL_get_ex_data
SSL_CTX_set_cipher_list
SSL_is_server
SSL_connect

libcrypto-1_1-x64

X509_NAME_get_index_by_NID
OPENSSL_sk_pop_free
X509_STORE_new
CRYPTO_free
X509_get_ext_d2i
OBJ_nid2obj
X509_STORE_add_lookup
X509_STORE_CTX_free
X509_digest
X509_STORE_CTX_get_current_cert
BIO_number_written
X509_STORE_CTX_set_verify_cb
X509_get_subject_name
X509_LOOKUP_hash_dir
ERR_print_errors_cb
X509_NAME_print_ex
X509_NAME_ENTRY_get_data
X509_STORE_CTX_get_error
PEM_read_bio_X509
X509_STORE_set_default_paths
ASN1_STRING_to_UTF8
X509_LOOKUP_ctrl
EVP_get_digestbyname
X509_verify_cert_error_string
OPENSSL_sk_find
ERR_error_string
X509_STORE_CTX_init
X509_STORE_set_flags
OPENSSL_sk_num
X509_STORE_CTX_new
OBJ_cmp
X509_STORE_CTX_get_error_depth
OPENSSL_init_crypto
X509_verify_cert
PEM_write_bio_RSA_PUBKEY
X509_set_pubkey
X509_new
PEM_read_bio_PUBKEY
BIO_get_retry_reason
BIO_meth_set_callback_ctrl
CRYPTO_get_ex_new_index
BIO_up_ref
PEM_read_bio_PrivateKey
X509_get0_pubkey
EVP_PKEY_id
X509_STORE_free
RSA_new
X509_free
OPENSSL_sk_free
X509_dup
RSA_set0_key
PEM_write_bio_X509
d2i_X509
i2d_X509
OPENSSL_sk_dup
EVP_PKEY_get1_RSA
RSA_free
i2d_PublicKey
RSA_get0_key
BIO_ctrl
ERR_get_error
BIO_new
BIO_callback_ctrl
ERR_peek_error
BIO_int_ctrl
BIO_free_all
BIO_push
ERR_error_string_n
BN_bin2bn
BN_clear_free
BN_CTX_free
BN_CTX_new
BN_bn2bin
BN_new
BIO_set_retry_reason
BIO_set_next
BIO_copy_next_retry
BIO_meth_set_ctrl
BIO_clear_flags
BN_num_bits
PEM_write_bio_PrivateKey
RSA_check_key
BIO_new_file
EVP_PKEY_up_ref
BIO_new_mem_buf
PEM_read_bio_RSAPrivateKey
BIO_s_secmem
EVP_PKEY_free
BIO_meth_new
BIO_meth_set_destroy
BIO_meth_set_puts
BIO_get_shutdown
BIO_meth_set_gets
GENERAL_NAME_free
ASN1_OBJECT_free
X509_STORE_CTX_set_purpose
X509_NAME_get_entry
EVP_PKEY_get_default_digest_nid
OPENSSL_sk_value
BIO_s_mem
X509_get_issuer_name
BN_mod_exp
BN_free
ERR_clear_error
BIO_write
BIO_read
BIO_test_flags
BIO_meth_set_read
BIO_set_shutdown
BIO_get_init
BIO_get_data
BIO_set_flags
BIO_set_init
BIO_meth_set_create
BIO_set_data
BIO_next
RAND_bytes
HMAC_Init_ex
EVP_DigestFinal_ex
EVP_DigestInit_ex
EVP_MD_CTX_new
HMAC_Update
EVP_MD_CTX_set_flags
HMAC_CTX_free
HMAC_CTX_new
EVP_DigestUpdate
EVP_MD_CTX_free
HMAC_Final
EVP_CIPHER_CTX_new
EVP_rc4
EVP_CIPHER_CTX_set_padding
EVP_CipherInit_ex
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_set_flags
EVP_CIPHER_CTX_set_key_length
EVP_CipherUpdate
EVP_CIPHER_CTX_reset
EVP_CipherFinal_ex
EVP_get_cipherbyname
EVP_EncryptInit_ex
FIPS_mode
FIPS_mode_set
BIO_meth_set_write

ws2_32

WSASetLastError
inet_ntop
getpeername
ioctlsocket
connect
select
WSAGetLastError
WSAEventSelect
getsockname
shutdown
setsockopt
recv
WSACreateEvent
WSAResetEvent
send
getsockopt
htonl
inet_pton
getaddrinfo
sendto
socket
freeaddrinfo
closesocket
WSAStartup
WSACleanup

winmm

waveInUnprepareHeader
waveInClose
waveInPrepareHeader
waveInOpen
waveInAddBuffer
waveOutPrepareHeader
waveOutGetNumDevs
waveOutOpen
waveOutUnprepareHeader
waveOutSetVolume
waveOutReset
waveOutGetVolume
waveOutWrite
waveOutClose
waveInStart
waveInGetDevCapsA
waveInGetErrorTextA
waveInGetNumDevs
waveInReset

kernel32

ExitProcess
GetModuleHandleExW
GetSystemTimeAsFileTime
GetFileType
SetStdHandle
GetConsoleMode
GetConsoleCP
DecodePointer
EncodePointer
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
GetModuleFileNameW
HeapSize
HeapQueryInformation
FlushFileBuffers
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ReadConsoleW
WriteConsoleW
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
CompareStringW
LCMapStringW
SetEnvironmentVariableA
LoadLibraryW
QueryPerformanceFrequency
lstrcmpW
GetOverlappedResult
LocalAlloc
CancelIo
GetProcessHeap
SetFileAttributesW
GetFileInformationByHandle
SetFileTime
CreateDirectoryW
SetFilePointerEx
SetEndOfFile
GetFileAttributesExW
GetDiskFreeSpaceW
GetLogicalDriveStringsA
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
CreateFileA
ResumeThread
CreateEventA
CreatePipe
GetStdHandle
TerminateProcess
CreateProcessA
TerminateThread
WriteFile
SetHandleInformation
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
InitializeCriticalSectionEx
SetLastError
GetTimeZoneInformation
WaitForSingleObjectEx
IsProcessorFeaturePresent
GetComputerNameExA
GetComputerNameA
WaitForMultipleObjectsEx
GetVersionExA
CloseThreadpool
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
CreateThreadpoolWork
GetNativeSystemInfo
CloseThreadpoolWork
WaitForMultipleObjects
InitializeCriticalSection
FreeLibrary
OutputDebugStringA
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetEnvironmentVariableW
FormatMessageW
GetCurrentProcess
DeleteFileW
RemoveDirectoryW
MoveFileW
CreateDirectoryA
MoveFileExW
lstrlenA
DeleteCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
InitOnceExecuteOnce
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetExitCodeThread
WideCharToMultiByte
GetCommandLineW
LocalFree
ExitThread
FormatMessageA
CreateThread
CloseHandle
GetFileTime
FindNextFileW
CreateEventW
LoadLibraryA
ResetEvent
FindClose
GlobalFree
GetProcAddress
GetLastError
GlobalUnlock
MultiByteToWideChar
CreateFileW
ReadFile
GetFileAttributesW
Sleep
GlobalAlloc
GetModuleHandleW
SetEvent
WaitForSingleObject
GlobalLock
GlobalSize
SetFilePointer
FindFirstFileW
GetFileSize
GetTickCount64

user32

CharUpperA
CharUpperBuffW
RegisterDeviceNotificationW
UnregisterDeviceNotification
CharUpperBuffA
GetKeyboardLayout
GetKeyboardLayoutNameA
SetTimer
LoadImageW
DrawTextW
KillTimer
TrackMouseEvent
InflateRect
SystemParametersInfoW
MoveWindow
MsgWaitForMultipleObjects
LoadCursorW
InsertMenuItemW
LoadIconW
PeekMessageW
ShowScrollBar
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
MessageBoxW
DestroyWindow
SetWindowRgn
SetWindowTextW
CloseClipboard
GetMessageW
PostMessageW
IsClipboardFormatAvailable
GetClipboardFormatNameA
EnumClipboardFormats
TranslateMessage
RegisterClassExW
GetClipboardData
EmptyClipboard
ChangeClipboardChain
CreateWindowExW
OpenClipboard
RegisterClipboardFormatW
SendMessageW
CountClipboardFormats
SetClipboardData
SetClipboardViewer
GetClipboardOwner
DispatchMessageW
CreateIconIndirect
GetDC
ReleaseDC
DestroyIcon
EndPaint
SetCursor
GetSystemMenu
ScreenToClient
PostQuitMessage
SetCapture
GetKeyState
CallNextHookEx
GetWindowLongPtrW
BeginPaint
GetForegroundWindow
GetGUIThreadInfo
GetAsyncKeyState
GetCursorPos
ReleaseCapture
ScrollWindowEx
UpdateWindow
SetScrollInfo
DefWindowProcW
CheckMenuItem
GetWindowThreadProcessId
GetWindowRect
FillRect
SetForegroundWindow
SetParent
GetClientRect
InvalidateRect
SetWindowPos
ShowWindow
GetSystemMetrics
SetWindowLongPtrW

gdi32

PatBlt
BitBlt
MoveToEx
LineTo
StretchBlt
SetTextColor
GdiFlush
CreateDIBSection
DeleteDC
CreateDIBitmap
CombineRgn
GetStockObject
CreateFontIndirectW
CreatePolygonRgn
SetBrushOrgEx
SetBkColor
CreateBitmap
SetBkMode
DeleteObject
CreateCompatibleDC
SelectObject
SelectClipRgn
CreateBrushIndirect
CreateRectRgn
CreatePatternBrush
Polyline
CreatePen
SetROP2
SetStretchBltMode
CreateSolidBrush

winspool.drv

OpenPrinterW
WritePrinter
EnumPrintersW
GetPrinterW
ClosePrinter
StartDocPrinterW
EndPagePrinter
ord203
StartPagePrinter

shell32

CommandLineToArgvW
SHCreateDirectoryExW
SHGetFolderPathA

ole32

CoInitializeEx
CoCreateInstance
OleGetClipboard
OleSetClipboard
CoTaskMemAlloc
CoTaskMemFree
ReleaseStgMedium
OleUninitialize
OleInitialize
OleIsCurrentClipboard
CoUninitialize

advapi32

RegOpenKeyExW
RegQueryValueExA
CredMarshalCredentialA
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
CryptGetUserKey
CryptDestroyKey
CryptGetProvParam
CryptEnumProvidersW
CryptReleaseContext
CryptGetKeyParam
CryptAcquireContextW
CredFree
CredReadW

Exports

Exports

?_log_cached_ptr@?3??gdi_CRgnToCRect@@9@9
?_log_cached_ptr@?3??gdi_CRgnToRect@@9@9
?_log_cached_ptr@?7??gdi_CRgnToCRect@@9@9
Bitmap_Alloc
Bitmap_SetDimensions
Bitmap_SetRectangle
FreeRDPAreColorFormatsEqualNoAlpha
FreeRDPGetColor
FreeRDPGetColorFormatName
FreeRDPReadColor
FreeRDPSplitColor
FreeRDPWriteColor
FreeRDPWriteColorIgnoreAlpha
FreeRDP_InitWtsApi
Glyph_Alloc
Pointer_Alloc
RdpClientEntry
VideoClient_CreateCommonContext
VideoClient_DestroyCommonContext
WTSChannelGetHandleById
WTSChannelGetHandleByName
WTSChannelGetId
WTSChannelGetIdByHandle
WTSChannelGetName
WTSChannelGetOptions
WTSChannelSetHandleById
WTSChannelSetHandleByName
WTSGetAcceptedChannelNames
WTSIsChannelJoinedById
WTSIsChannelJoinedByName
WTSVirtualChannelManagerCheckFileDescriptor
WTSVirtualChannelManagerCheckFileDescriptorEx
WTSVirtualChannelManagerGetDrdynvcState
WTSVirtualChannelManagerGetEventHandle
WTSVirtualChannelManagerIsChannelJoined
WTSVirtualChannelManagerOpen
WTSVirtualChannelManagerSetDVCCreationCallback
_ber_sizeof_length
audio_format_compatible
audio_format_compute_time_length
audio_format_copy
audio_format_free
audio_format_get_tag_string
audio_format_new
audio_format_print
audio_format_read
audio_format_write
audio_formats_free
audio_formats_new
audio_formats_print
autodetect_get
avc420_compress
avc420_decompress
avc444_compress
avc444_decompress
ber_read_BOOL
ber_read_application_tag
ber_read_bit_string
ber_read_char_from_unicode_octet_string
ber_read_contextual_tag
ber_read_enumerated
ber_read_integer
ber_read_integer_length
ber_read_length
ber_read_octet_string
ber_read_octet_string_tag
ber_read_sequence_tag
ber_read_unicode_octet_string
ber_read_universal_tag
ber_sizeof_contextual_integer
ber_sizeof_contextual_octet_string
ber_sizeof_contextual_tag
ber_sizeof_integer
ber_sizeof_octet_string
ber_sizeof_sequence
ber_sizeof_sequence_tag
ber_write_BOOL
ber_write_application_tag
ber_write_char_to_unicode_octet_string
ber_write_contextual_char_to_unicode_octet_string
ber_write_contextual_integer
ber_write_contextual_octet_string
ber_write_contextual_tag
ber_write_contextual_unicode_octet_string
ber_write_enumerated
ber_write_integer
ber_write_length
ber_write_octet_string
ber_write_octet_string_tag
ber_write_sequence_tag
ber_write_universal_tag
bitmap_interleaved_context_free
bitmap_interleaved_context_new
bitmap_interleaved_context_reset
channel_client_create_handler
checkChannelErrorEvent
clearChannelError
clear_compress
clear_context_free
clear_context_new
clear_context_reset
clear_decompress
client_auto_reconnect
client_auto_reconnect_ex
client_cli_authenticate_ex
client_cli_choose_smartcard
client_cli_logon_error_info
client_cli_present_gateway_message
client_cli_verify_certificate_ex
client_cli_verify_changed_certificate_ex
client_rail_server_start_cmd
codecs_free
codecs_new
crypto_base64_decode
crypto_base64_encode
crypto_read_pem
crypto_write_pem
drdynvc_get_packet_type
freerdp_abort_connect
freerdp_abort_connect_context
freerdp_abort_event
freerdp_add_signal_cleanup_handler
freerdp_addin_argv_add_argument
freerdp_addin_argv_add_argument_ex
freerdp_addin_argv_clone
freerdp_addin_argv_del_argument
freerdp_addin_argv_free
freerdp_addin_argv_new
freerdp_addin_replace_argument
freerdp_addin_replace_argument_value
freerdp_addin_set_argument
freerdp_addin_set_argument_value
freerdp_assistance_bin_to_hex_string
freerdp_assistance_construct_expert_blob
freerdp_assistance_encrypt_pass_stub
freerdp_assistance_file_free
freerdp_assistance_file_new
freerdp_assistance_generate_pass_stub
freerdp_assistance_get_encrypted_pass_stub
freerdp_assistance_hex_string_to_bin
freerdp_assistance_parse_file
freerdp_assistance_parse_file_buffer
freerdp_assistance_populate_settings_from_assistance_file
freerdp_assistance_print_file
freerdp_assistance_set_connection_string2
freerdp_bitmap_compress
freerdp_bitmap_compress_planar
freerdp_bitmap_planar_context_free
freerdp_bitmap_planar_context_new
freerdp_bitmap_planar_context_reset
freerdp_capability_buffer_copy
freerdp_capability_buffer_free
freerdp_certificate_check_eku
freerdp_certificate_data_equal
freerdp_certificate_data_free
freerdp_certificate_data_get_fingerprint
freerdp_certificate_data_get_hash
freerdp_certificate_data_get_host
freerdp_certificate_data_get_issuer
freerdp_certificate_data_get_pem
freerdp_certificate_data_get_port
freerdp_certificate_data_get_subject
freerdp_certificate_data_hash
freerdp_certificate_data_new
freerdp_certificate_data_new_from_file
freerdp_certificate_data_new_from_pem
freerdp_certificate_free
freerdp_certificate_free_dns_names
freerdp_certificate_get_common_name
freerdp_certificate_get_der
freerdp_certificate_get_dns_names
freerdp_certificate_get_email
freerdp_certificate_get_fingerprint
freerdp_certificate_get_fingerprint_by_hash
freerdp_certificate_get_fingerprint_by_hash_ex
freerdp_certificate_get_hash
freerdp_certificate_get_issuer
freerdp_certificate_get_pem
freerdp_certificate_get_public_key
freerdp_certificate_get_signature_alg
freerdp_certificate_get_subject
freerdp_certificate_get_upn
freerdp_certificate_is_rsa
freerdp_certificate_new
freerdp_certificate_new_from_der
freerdp_certificate_new_from_file
freerdp_certificate_new_from_pem
freerdp_certificate_store_contains_data
freerdp_certificate_store_free
freerdp_certificate_store_get_certs_path
freerdp_certificate_store_get_hosts_path
freerdp_certificate_store_load_data
freerdp_certificate_store_new
freerdp_certificate_store_remove_data
freerdp_certificate_store_save_data
freerdp_certificate_verify
freerdp_channels_addin_list_free
freerdp_channels_attach
freerdp_channels_check_fds
freerdp_channels_client_find_static_entry
freerdp_channels_client_load
freerdp_channels_client_load_ex
freerdp_channels_data
freerdp_channels_detach
freerdp_channels_from_mcs
freerdp_channels_get_event_handle
freerdp_channels_get_id_by_name
freerdp_channels_get_name_by_id
freerdp_channels_get_static_channel_interface
freerdp_channels_list_addins
freerdp_channels_load_plugin
freerdp_channels_load_static_addin_entry
freerdp_channels_process_pending_messages
freerdp_check_event_handles
freerdp_check_fds
freerdp_client_OnChannelConnectedEventHandler
freerdp_client_OnChannelDisconnectedEventHandler
freerdp_client_add_device_channel
freerdp_client_add_dynamic_channel
freerdp_client_add_static_channel
freerdp_client_codecs_prepare
freerdp_client_codecs_reset
freerdp_client_common_stop
freerdp_client_context_free
freerdp_client_context_new
freerdp_client_del_dynamic_channel
freerdp_client_del_static_channel
freerdp_client_encomsp_set_control
freerdp_client_encomsp_toggle_control
freerdp_client_get_instance
freerdp_client_get_thread
freerdp_client_handle_touch
freerdp_client_load_addins
freerdp_client_load_channels
freerdp_client_parse_rdp_file
freerdp_client_parse_rdp_file_buffer
freerdp_client_parse_rdp_file_buffer_ex
freerdp_client_parse_rdp_file_ex
freerdp_client_populate_rdp_file_from_settings
freerdp_client_populate_settings_from_rdp_file
freerdp_client_print_buildconfig
freerdp_client_print_command_line_help
freerdp_client_print_command_line_help_ex
freerdp_client_print_version
freerdp_client_rdp_file_free
freerdp_client_rdp_file_get_integer_option
freerdp_client_rdp_file_get_string_option
freerdp_client_rdp_file_new
freerdp_client_rdp_file_new_ex
freerdp_client_rdp_file_set_callback_context
freerdp_client_rdp_file_set_integer_option
freerdp_client_rdp_file_set_string_option
freerdp_client_send_button_event
freerdp_client_send_extended_button_event
freerdp_client_send_wheel_event
freerdp_client_set_window_size
freerdp_client_settings_command_line_status_print
freerdp_client_settings_command_line_status_print_ex
freerdp_client_settings_parse_assistance_file
freerdp_client_settings_parse_command_line
freerdp_client_settings_parse_command_line_arguments
freerdp_client_settings_parse_connection_file
freerdp_client_settings_parse_connection_file_buffer
freerdp_client_settings_write_connection_file
freerdp_client_start
freerdp_client_stop
freerdp_client_warn_deprecated
freerdp_client_warn_experimental
freerdp_client_write_rdp_file
freerdp_client_write_rdp_file_buffer
freerdp_codepages_free
freerdp_connect
freerdp_context_free
freerdp_context_new
freerdp_context_new_ex
freerdp_context_reset
freerdp_del_signal_cleanup_handler
freerdp_detect_keyboard_layout_from_system_locale
freerdp_device_clone
freerdp_device_collection_add
freerdp_device_collection_find
freerdp_device_collection_find_type
freerdp_device_collection_free
freerdp_device_equal
freerdp_device_free
freerdp_device_new
freerdp_disconnect
freerdp_disconnect_before_reconnect
freerdp_disconnect_before_reconnect_context
freerdp_display_send_monitor_layout
freerdp_dsp_context_free
freerdp_dsp_context_new
freerdp_dsp_context_reset
freerdp_dsp_decode
freerdp_dsp_encode
freerdp_dsp_supports_format
freerdp_dynamic_channel_collection_add
freerdp_dynamic_channel_collection_del
freerdp_dynamic_channel_collection_find
freerdp_dynamic_channel_collection_free
freerdp_encryption_level_string
freerdp_encryption_methods_string
freerdp_error_info
freerdp_focus_required
freerdp_free
freerdp_generic_DVCPluginEntry
freerdp_get_build_config
freerdp_get_build_revision
freerdp_get_current_addin_provider
freerdp_get_disconnect_ultimatum
freerdp_get_dynamic_addin_install_path
freerdp_get_error_base_category
freerdp_get_error_base_name
freerdp_get_error_base_string
freerdp_get_error_connect_category
freerdp_get_error_connect_name
freerdp_get_error_connect_string
freerdp_get_error_info_category
freerdp_get_error_info_name
freerdp_get_error_info_string
freerdp_get_event_handles
freerdp_get_io_callback_context
freerdp_get_io_callbacks
freerdp_get_last_error
freerdp_get_last_error_category
freerdp_get_last_error_name
freerdp_get_last_error_string
freerdp_get_library_install_path
freerdp_get_logon_error_info_data
freerdp_get_logon_error_info_type
freerdp_get_message_queue
freerdp_get_message_queue_event_handle
freerdp_get_nla_sspi_error
freerdp_get_state
freerdp_get_stats
freerdp_get_system_locale_id
freerdp_get_system_locale_name_from_id
freerdp_get_transport
freerdp_get_transport_sent
freerdp_get_version
freerdp_get_version_string
freerdp_glyph_convert
freerdp_handle_signals
freerdp_heartbeat_send_heartbeat_pdu
freerdp_image_copy
freerdp_image_copy_from_icon_data
freerdp_image_copy_from_monochrome
freerdp_image_copy_from_pointer_data
freerdp_image_fill
freerdp_image_scale
freerdp_input_send_extended_mouse_event
freerdp_input_send_focus_in_event
freerdp_input_send_keyboard_event
freerdp_input_send_keyboard_event_ex
freerdp_input_send_keyboard_pause_event
freerdp_input_send_mouse_event
freerdp_input_send_synchronize_event
freerdp_input_send_unicode_keyboard_event
freerdp_interruptible_get_line
freerdp_interruptible_getc
freerdp_io_callback_set_event
freerdp_is_active_state
freerdp_is_valid_mcs_create_request
freerdp_is_valid_mcs_create_response
freerdp_key_free
freerdp_key_is_rsa
freerdp_key_new
freerdp_key_new_from_file
freerdp_key_new_from_pem
freerdp_keyboard_get_layout_id_from_name
freerdp_keyboard_get_layout_name_from_id
freerdp_keyboard_get_layouts
freerdp_keyboard_get_matching_codepages
freerdp_keyboard_get_rdp_scancode_from_x11_keycode
freerdp_keyboard_get_x11_keycode_from_rdp_scancode
freerdp_keyboard_init
freerdp_keyboard_init_ex
freerdp_keyboard_layouts_free
freerdp_keyboard_scancode_name
freerdp_load_channel_addin_entry
freerdp_load_dynamic_addin
freerdp_load_dynamic_channel_addin_entry
freerdp_message_queue_process_message
freerdp_message_queue_process_pending_messages
freerdp_nego_get_routing_token
freerdp_new
freerdp_nla_impersonate
freerdp_nla_revert_to_self
freerdp_parse_hostname
freerdp_parse_username
freerdp_passphrase_read
freerdp_peer_context_free
freerdp_peer_context_new
freerdp_peer_context_new_ex
freerdp_peer_free
freerdp_peer_new
freerdp_peer_os_major_type_string
freerdp_peer_os_minor_type_string
freerdp_performance_flags_make
freerdp_performance_flags_split
freerdp_planar_switch_bgr
freerdp_planar_topdown_image
freerdp_rail_support_flags_to_string
freerdp_rdp_version_string
freerdp_rdpdr_dtyp_string
freerdp_rdpsnd_get_context
freerdp_reconnect
freerdp_register_addin_provider
freerdp_send_error_info
freerdp_server_license_issuers_copy
freerdp_server_license_issuers_free
freerdp_set_connection_type
freerdp_set_error_info
freerdp_set_focus
freerdp_set_gateway_usage_method
freerdp_set_io_callback_context
freerdp_set_io_callbacks
freerdp_set_last_error
freerdp_set_last_error_ex
freerdp_settings_clone
freerdp_settings_copy
freerdp_settings_dump
freerdp_settings_free
freerdp_settings_get_bool
freerdp_settings_get_codecs_flags
freerdp_settings_get_int16
freerdp_settings_get_int32
freerdp_settings_get_int64
freerdp_settings_get_key_for_name
freerdp_settings_get_name_for_key
freerdp_settings_get_pointer
freerdp_settings_get_pointer_array
freerdp_settings_get_pointer_array_writable
freerdp_settings_get_pointer_writable
freerdp_settings_get_server_name
freerdp_settings_get_string
freerdp_settings_get_string_as_utf16
freerdp_settings_get_string_writable
freerdp_settings_get_type_for_key
freerdp_settings_get_type_for_name
freerdp_settings_get_type_name_for_key
freerdp_settings_get_type_name_for_type
freerdp_settings_get_uint16
freerdp_settings_get_uint32
freerdp_settings_get_uint64
freerdp_settings_new
freerdp_settings_print_diff
freerdp_settings_set_bool
freerdp_settings_set_int16
freerdp_settings_set_int32
freerdp_settings_set_int64
freerdp_settings_set_pointer
freerdp_settings_set_pointer_array
freerdp_settings_set_pointer_len
freerdp_settings_set_string
freerdp_settings_set_string_from_utf16
freerdp_settings_set_string_from_utf16N
freerdp_settings_set_string_len
freerdp_settings_set_uint16
freerdp_settings_set_uint32
freerdp_settings_set_uint64
freerdp_settings_set_value_for_name
freerdp_settings_update_from_caps
freerdp_shall_disconnect
freerdp_shall_disconnect_context
freerdp_smartcard_list
freerdp_state_string
freerdp_static_channel_collection_add
freerdp_static_channel_collection_del
freerdp_static_channel_collection_find
freerdp_static_channel_collection_free
freerdp_target_net_addresses_copy
freerdp_target_net_addresses_free
freerdp_update_gateway_usage_method
gdi_BitBlt
gdi_CRectToCRgn
gdi_CRectToRgn
gdi_CRgnToCRect
gdi_CRgnToRect
gdi_CopyOverlap
gdi_CopyRect
gdi_CreateBitmap
gdi_CreateBitmapEx
gdi_CreateCompatibleBitmap
gdi_CreateCompatibleDC
gdi_CreateDC
gdi_CreatePen
gdi_CreateRect
gdi_CreateRectRgn
gdi_DeleteDC
gdi_DeleteObject
gdi_Ellipse
gdi_EqualRgn
gdi_FillRect
gdi_GetDC
gdi_GetPenColor
gdi_GetPixel
gdi_GetPointer
gdi_InvalidateRegion
gdi_PolyPolygon

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 814KB - Virtual size: 813KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d3b7819d2099b7489e93b967c262426

Headers

DLL Characteristics

File Characteristics

Imports

msimg32

credui

ntdll

crypt32

ncrypt

dbghelp

rpcrt4

shlwapi

libssl-1_1-x64

libcrypto-1_1-x64

ws2_32

winmm

kernel32

user32

gdi32

winspool.drv

shell32

ole32

advapi32

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 814KB - Virtual size: 813KB

.data Size: 16KB - Virtual size: 319KB

.pdata Size: 147KB - Virtual size: 147KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 158KB - Virtual size: 157KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 814KB - Virtual size: 813KB

.data
Size: 16KB - Virtual size: 319KB

.pdata
Size: 147KB - Virtual size: 147KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 158KB - Virtual size: 157KB

.reloc
Size: 15KB - Virtual size: 15KB