Static task
static1
Behavioral task
behavioral1
Sample
rdp.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
rdp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
rdp.exe
Resource
win11-20240802-en
General
-
Target
rdp.exe
-
Size
261KB
-
MD5
c56cd6a873e360c58dc80796e1ff6cde
-
SHA1
49be32431f0e18d8266f0cc2e561a23aca092a0c
-
SHA256
ba4f0f99a57739a9bc7612c95496305fda3afbfea012c9478a66299f69c650df
-
SHA512
aaed7750d1207d04cd5726d79692bf09323352a6f3b9d4b5fd6c839531f2ea99f05dd85e443e4473398b52ebc753715b30e0731202861102d4cae4ac7f9c5fbe
-
SSDEEP
6144:xbDHWT8YkZRXn4X8PiAEiT4pLTpHn6H9Ll20kKqiySU:xbBXoxnaZQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rdp.exe
Files
-
rdp.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ