Rdesktop[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Rdesktop.exe.zip
Size

283KB
MD5

236804f521a913695818c6f67c0cf409
SHA1

46ec2ced3dcd9440ac7028d5bed11ece19e84a95
SHA256

c14c861d0901dd459af64a343f8a8d4a2acff822558abae3dc1d4b81c50bfa7f
SHA512

88bcd42660a75eb43f382ee030c39bffb3e4f0ed8c72cb1fbe788aed22210b81476e403e31dfd7ad5d81f15833ec5d154d559da3b68a1222c565ddc86861c2b3
SSDEEP

6144:jtuiOnOcscTwOQ6oWiJndF8Z1afsU6TTzGMnoLluJeIgs/7MejVr:jPOnOcsQLQ62dF8Z1aUU6TvDnIluJv7h

Score

1^/10

Malware Config

Signatures

Files

Rdesktop.exe.zip
.zip

Password: infected
Rdesktop.exe
.exe windows x86

bccdd445b742625b58d82dcd9c833850

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

WSACleanup
gethostname
inet_addr
WSAStartup
WSAGetLastError
recv
send
getsockname
getpeername
accept
listen
ioctlsocket
connect
htons
htonl
bind
shutdown
closesocket
socket
setsockopt
gethostbyname

winmm

timeGetTime

kernel32

FlushFileBuffers
WriteFile
GlobalLock
GlobalAlloc
GetVersionExA
WaitForSingleObject
SetThreadPriority
GetCurrentThread
OpenEventA
SetProcessShutdownParameters
TerminateProcess
CreateProcessA
LockResource
LoadResource
SizeofResource
FindResourceA
ReleaseMutex
CreateMutexA
GetStdHandle
AllocConsole
SetEndOfFile
SetFilePointer
MoveFileExA
FormatMessageA
OutputDebugStringA
WriteConsoleA
SearchPathA
HeapSize
HeapReAlloc
ExitThread
SystemTimeToFileTime
GetVersion
GetCommandLineA
GetStartupInfoA
GetFileType
SetStdHandle
ExitProcess
InterlockedIncrement
InterlockedDecrement
GetLocalTime
GetTimeZoneInformation
HeapFree
HeapAlloc
RtlUnwind
TlsGetValue
TlsFree
TlsAlloc
DuplicateHandle
TlsSetValue
CreateSemaphoreA
ReleaseSemaphore
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
SetFileTime
GlobalUnlock
GlobalFree
GetFileSize
GetFileTime
FileTimeToSystemTime
ReadFile
GetLogicalDriveStringsA
GetDriveTypeA
SetErrorMode
lstrlenA
CreateDirectoryA
GetSystemTime
GetCurrentProcessId
GetModuleHandleA
GetCurrentThreadId
Beep
Sleep
DeviceIoControl
CreateFileA
IsBadReadPtr
IsBadWritePtr
CreateThread
ResumeThread
GetComputerNameA
SetLastError
CloseHandle
GetCurrentProcess
OpenProcess
GetLastError
EnterCriticalSection
LeaveCriticalSection
CopyFileA
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteFileA
GetModuleFileNameA
FindFirstFileA
FindNextFileA
FindClose
LCMapStringW
SetHandleCount
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
CompareStringA
CompareStringW
SetEnvironmentVariableA
RaiseException
InterlockedExchange

user32

GetProcessWindowStation
GetUserObjectInformationA
ExitWindowsEx
EnableWindow
GetSubMenu
SetMenuDefaultItem
PostThreadMessageA
GetMenuItemID
EnableMenuItem
DestroyMenu
LoadIconA
LoadMenuA
VkKeyScanA
MapVirtualKeyA
GetAsyncKeyState
SetRect
PeekMessageA
WaitMessage
TranslateMessage
DispatchMessageA
IsIconic
WaitForInputIdle
GetMessageA
TrackPopupMenu
GetParent
GetClipboardOwner
GetClipboardData
DefWindowProcA
PostQuitMessage
IsWindowVisible
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetCursorPos
GetIconInfo
LoadCursorA
RegisterClassExA
CreateWindowExA
SetClipboardViewer
IsWindow
EnumWindows
GetWindowTextA
OpenDesktopA
EnumDesktopWindows
SystemParametersInfoA
GetClassNameA
ChangeClipboardChain
DestroyWindow
KillTimer
GetDesktopWindow
WindowFromPoint
GetWindowRect
RegisterWindowMessageA
GetSystemMetrics
mouse_event
InvalidateRect
wsprintfA
GetKeyboardState
keybd_event
SetTimer
GetForegroundWindow
SetActiveWindow
MessageBeep
FlashWindow
GetThreadDesktop
SetThreadDesktop
OpenInputDesktop
CloseDesktop
EnumDisplaySettingsA
GetDC
ReleaseDC
GetWindowLongA
EndDialog
GetDlgItemTextA
SetFocus
SetWindowLongA
SetWindowTextA
LoadStringA
SetForegroundWindow
DialogBoxParamA
GetScrollInfo
PostMessageA
SetDlgItemTextA
GetDlgItem
SendDlgItemMessageA
MessageBoxA
FindWindowA
GetWindowThreadProcessId
SendMessageA
DrawIconEx

gdi32

GetObjectA
GetBitmapBits
GdiFlush
CreateDIBSection
GetStockObject
CreatePalette
SelectPalette
RealizePalette
SetDIBColorTable
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
GetPixel
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
ExtEscape
CreateDCA
GetSystemPaletteEntries
DeleteObject

shell32

SHAppBarMessage
Shell_NotifyIconA

advapi32

ImpersonateLoggedOnUser
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegOpenKeyA
RegDeleteValueA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
SetTokenInformation
CreateProcessAsUserA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken
RevertToSelf

ole32

CoUninitialize
CoCreateInstance
CoInitialize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 316KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

bccdd445b742625b58d82dcd9c833850

Headers

File Characteristics

Imports

wsock32

winmm

kernel32

user32

gdi32

shell32

advapi32

ole32

version

Sections

.text Size: 316KB - Virtual size: 314KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 56KB - Virtual size: 134KB

.rsrc Size: 148KB - Virtual size: 145KB

.text
Size: 316KB - Virtual size: 314KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 56KB - Virtual size: 134KB

.rsrc
Size: 148KB - Virtual size: 145KB