Static task
static1
Behavioral task
behavioral1
Sample
RDWorksV8Setup8.01.62-20221020/Lang/Help.chm
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
RDWorksV8Setup8.01.62-20221020/Lang/Help.chm
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
RDWorksV8Setup8.01.62-20221020/RDWorksV8Setup8.01.62-20221020.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
RDWorksV8Setup8.01.62-20221020/RDWorksV8Setup8.01.62-20221020.exe
Resource
win10v2004-20240709-en
General
-
Target
RDWorksV8Setup8.01.62-20221020.zip
-
Size
66.5MB
-
MD5
ba61386964d14507f7be4c954c0215df
-
SHA1
6acdb9ff1ed5a2c6620f887b177f4c9308a0fd53
-
SHA256
d5f4a647479ca4acd7706c13aa07d913a12f3a9e4b2bc42d918244dbefa987ae
-
SHA512
0f1caae174686eabde2414e603d41200e693a76b0d0de76b9f6c513eea0cedcff085f3f35422991ae4035df4c6bb3f97b4ea664cc902e13b53e7081d64caf6c2
-
SSDEEP
1572864:YEwWa4kKOaCw4y9RWxOxbVgqgxT1fq8C4lVS8vLWHclJeHDdkIkk17In:O4Q+9R1xbVFgxTBdZv1HSDYHn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RDWorksV8Setup8.01.62-20221020/RDWorksV8Setup8.01.62-20221020.exe
Files
-
RDWorksV8Setup8.01.62-20221020.zip.zip
Password: 123456
-
RDWorksV8Setup8.01.62-20221020/CFG/ImgLib/Thunder laser
-
RDWorksV8Setup8.01.62-20221020/CFG/Param.lib
-
RDWorksV8Setup8.01.62-20221020/CFG/config
-
RDWorksV8Setup8.01.62-20221020/CFG/custom
-
RDWorksV8Setup8.01.62-20221020/CFG/plug_config
-
RDWorksV8Setup8.01.62-20221020/CFG/soft.ini
-
RDWorksV8Setup8.01.62-20221020/CFG/tips
-
RDWorksV8Setup8.01.62-20221020/Info/Info_En.txt
-
RDWorksV8Setup8.01.62-20221020/Info/Info_Other.txt
-
RDWorksV8Setup8.01.62-20221020/Info/Info_SChe.txt
-
RDWorksV8Setup8.01.62-20221020/Info/Info_TChe.txt
-
RDWorksV8Setup8.01.62-20221020/Lang/Help.chm.chm
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_1.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_10.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_11.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_12.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_13.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_14.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_15.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_16.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_17.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_2.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_3.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_4.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_5.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_6.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_7.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_8.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/LGP_9.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_1.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_10.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_11.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_12.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_13.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_14.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_15.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_16.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_17.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_2.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_3.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_4.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_5.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_6.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_7.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_8.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Lang_9.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_1.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_10.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_11.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_12.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_13.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_14.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_15.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_16.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_17.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_2.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_3.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_4.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_5.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_6.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_7.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_8.ini
-
RDWorksV8Setup8.01.62-20221020/Lang/Preview_9.ini
-
RDWorksV8Setup8.01.62-20221020/RDWorksV8Setup8.01.62-20221020.exe.exe windows:4 windows x86 arch:x86
Password: 123456
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
RDWorksV8Setup8.01.62-20221020/Readme.txt
-
RDWorksV8Setup8.01.62-20221020/Res/Logo.ico
-
RDWorksV8Setup8.01.62-20221020/Res/RLD.ico
-
RDWorksV8Setup8.01.62-20221020/Res/Splash.bmp
-
RDWorksV8Setup8.01.62-20221020/Res/Thumbs.db