RDPWrapOffsetFinder[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RDPWrapOffsetFinder.exe
Size

16KB
MD5

e6203af0411dc5109f0c5cfe174f1887
SHA1

49c408bf6acea734516d4eafbb2b759d4938a2f9
SHA256

e2a4da4652e19ff334759beaea53644179310b0ccc1cf6a9193366d378bfa6ea
SHA512

74574f962be0a9de44f5d2afef6f8966393a111e0de7a0cf15630d8783d58d5a0e7d1e48cfe62fb168dc07047d3ef2117acf39042eb0688bb25506aea825e42b
SSDEEP

384:OHQOH762AE6fjWzvdGOGQOvzu+W8+WA3s:OHP7OjEvdGfvz/W8+N3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RDPWrapOffsetFinder.exe

Files

RDPWrapOffsetFinder.exe
.exe windows:6 windows x64 arch:x64

9266c55b4c46ad4062eae2fc57f9d3bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

zydis

ZydisDecoderInit
ZydisDecoderDecodeInstruction
ZydisDecoderDecodeFull
ZydisRegisterGetString

dbghelp

SymFromNameW
SymLoadModuleEx
SymInitializeW
SymSetOptions

kernel32

LoadResource
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcess
LoadLibraryExA
GetEnvironmentVariableW
GetLastError
GetSystemDirectoryA
lstrcpyA
QueryPerformanceCounter
FindResourceW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

vcruntime140

memset
__current_exception_context
__current_exception
__C_specific_handler
memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vfprintf
puts
__acrt_iob_func
__stdio_common_vfprintf_p
_set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_initterm
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_exit
_seh_filter_exe
_initialize_narrow_environment
_get_initial_narrow_environment
_configure_narrow_argv
exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9266c55b4c46ad4062eae2fc57f9d3bc

Headers

DLL Characteristics

File Characteristics

Imports

zydis

dbghelp

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 7KB - Virtual size: 8KB

.rdata Size: 7KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 512B - Virtual size: 396B

.text
Size: 7KB - Virtual size: 8KB

.rdata
Size: 7KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 512B - Virtual size: 396B