RdpSa[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

RdpSa.exe
Size

35KB
MD5

792537669273eac584c591c492f7f4fa
SHA1

d1286220ea20ed9f1dc6574fe308a4d68a2cc473
SHA256

ccbb7d0f769eef59f08d47b9ad3766b1b46319e680e5f6ad560f8347c6f0ed75
SHA512

5f54b3aec6eb45eb080b6f912121a131211b626d77b0573779c63fc4f9fb7991c7a58a1e4863e0bde39c1134b61e2a057b772bfaed28e26d3c574e3f73385d26
SSDEEP

768:YwGisVmotkm5DE63whA/bDopJ2ddi2y6ZI5kvltpFjRzsQHX:YwGvHQJ2wiI2vltpF5sQ3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RdpSa.exe

Files

RdpSa.exe
.exe windows x86

e98bb32923fd9edeaf896289b34c1a37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
OpenProcessToken
RegOpenKeyExW
RegNotifyChangeKeyValue
RegGetValueW
SetSecurityInfo
AddAce
GetAce
AddAccessDeniedAce
InitializeAcl
GetLengthSid
GetSecurityInfo
GetTokenInformation

kernel32

CreateEventW
Sleep
WaitForSingleObject
MapViewOfFile
SetEvent
UnmapViewOfFile
FormatMessageW
LocalFree
LocalAlloc
TerminateProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
HeapFree
GetProcessHeap
HeapAlloc
FreeLibrary
GetProcAddress
GetModuleHandleExA
GetCurrentProcessId
ProcessIdToSessionId
CloseHandle
GetCurrentProcess
HeapSetInformation
HeapReAlloc
GetLastError

user32

PostQuitMessage
DispatchMessageW
RegisterClassExW
CreateWindowExW
KillTimer
DestroyWindow
SetWindowLongW
GetWindowLongW
DefWindowProcW
SetTimer
GetMessageW
TranslateMessage
LoadStringW

msvcrt

_wcmdln
_XcptFilter
??2@YAPAXI@Z
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
??3@YAXPAX@Z
_vsnwprintf
_purecall
__p__commode
memset
memcmp
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp
_except_handler4_common
_cexit
__p__fmode
__setusermatherr
_initterm

ws2_32

FreeAddrInfoW
GetNameInfoW
GetAddrInfoW

ntdll

EtwEventRegister
EtwEventWriteFull
EtwEventUnregister

ole32

CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
MkParseDisplayName
StringFromCLSID
CreateBindCtx

oleaut32

SysAllocString
SysStringLen
SysAllocStringByteLen
SysFreeString

secur32

GetUserNameExW

winsta

WinStationSendMessageW
WinStationShadowStop2

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e98bb32923fd9edeaf896289b34c1a37

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ws2_32

ntdll

ole32

oleaut32

secur32

winsta

Sections

.text Size: 23KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 1012B

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 23KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 1012B

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 4KB