rclient[.]vmp[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

rclient.vmp.exe
Size

14.9MB
MD5

f67b190a5a3f30621f4e8ce781d86adb
SHA1

fb14972529dc470bb9ba5417dbd1d5d6713314f3
SHA256

12c447f20c26e711c62932bb229609da8f656fdca8d4769d9d20c670ac0ac47c
SHA512

e185ae10c723ac547115e6d42c1c97cac7df21a28397b65371dbbc9ae9f6f49a65fc9cfde329657e7fce5fcdeeeea0f87d66c5dc961daa634503b169b71aa8d8
SSDEEP

393216:ilFijIEpjVaDKUfJfG7838sipwc8/Y6M:ilFC1URm838d2P/Y6M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rclient.vmp.exe

Files

rclient.vmp.exe
.exe windows:6 windows x64 arch:x64

d016e48ac4a54478a37ed71ee8390c92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll

kernel32

GetCurrentProcess
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

advapi32

RegQueryValueExW

iphlpapi

GetAdaptersInfo

ws2_32

WSASocketW

ntdll

RtlNtStatusToDosError

vcruntime140

memset

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free

Sections

.text
Size: - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.TYk
Size: - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.aj!
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KJ)
Size: 14.9MB - Virtual size: 14.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d016e48ac4a54478a37ed71ee8390c92

Headers

DLL Characteristics

File Characteristics

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

iphlpapi

ws2_32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: - Virtual size: 332KB

.rdata Size: - Virtual size: 216KB

.data Size: - Virtual size: 872B

.pdata Size: - Virtual size: 12KB

.TYk Size: - Virtual size: 8.7MB

.aj! Size: 3KB - Virtual size: 2KB

.KJ) Size: 14.9MB - Virtual size: 14.9MB

.reloc Size: 512B - Virtual size: 276B

.text
Size: - Virtual size: 332KB

.rdata
Size: - Virtual size: 216KB

.data
Size: - Virtual size: 872B

.pdata
Size: - Virtual size: 12KB

.TYk
Size: - Virtual size: 8.7MB

.aj!
Size: 3KB - Virtual size: 2KB

.KJ)
Size: 14.9MB - Virtual size: 14.9MB

.reloc
Size: 512B - Virtual size: 276B