RDCMan[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

RDCMan.exe
Size

1.8MB
MD5

3d756dc27945a345de1f2ed0ea0940b1
SHA1

af536d4c3366b58594a6d15d3fc51715bbae933c
SHA256

d11cf847df9dac6eda1891022986729efe690b3db8e6f876bef4e7a6afffc759
SHA512

3832dd9cedc14656ec2cc9a43d620236df752468b8f37bd391407467981ab358937df91e4f644d31d0341dced3188acb8683969e813391dbef306af0dbab5e22
SSDEEP

49152:49wTrUVoE/g0A3nxPuWPKCI96W8u8eylSiB:mwTaz8u8LlSiB

Score

1^/10

Malware Config

Signatures

Files

RDCMan.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:22:a6:2f:5a:ae:da:3e:da:7d:0d:b1:fe:59:11:01:c5:77:32:89:89:22:8e:f6:64:4f:9e:c9:00:06:40:b6
Signer

Actual PE Digest

cd:22:a6:2f:5a:ae:da:3e:da:7d:0d:b1:fe:59:11:01:c5:77:32:89:89:22:8e:f6:64:4f:9e:c9:00:06:40:b6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB Paths

D:\a\1\s\src\bin\Release\RDCMan.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

cd:22:a6:2f:5a:ae:da:3e:da:7d:0d:b1:fe:59:11:01:c5:77:32:89:89:22:8e:f6:64:4f:9e:c9:00:06:40:b6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rsrc Size: 28KB - Virtual size: 28KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

cd:22:a6:2f:5a:ae:da:3e:da:7d:0d:b1:fe:59:11:01:c5:77:32:89:89:22:8e:f6:64:4f:9e:c9:00:06:40:b6
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 512B - Virtual size: 12B