RDPWrap-v1[.]6[.]2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
RDPWrap-v1.6.2.zip
Size 1.5MB
Sample260606-j63fdact7n
SHA256 35a9481ddbed5177431a9ea4bd09468fe987797d7b1231d64942d17eb54ec269
MD5 c26a2c5f6154225e8d83c4000306f162
SHA1 67c586cedbf0852aa52268311841cbac5c96fdf8
SHA512 d0977bd568d05c20ae3a099a3b9eb44c5ea379060d1470832be933ae98cb517b68509ac0f8679242984e64aef75dc5de5e65f094795fcdc881427ae475fe7c51
SSDEEP 49152:cPEbpqUPr0OMPjmNgyV24OXxr2/NV0CA7QUmu4LnB:cPEbpPPrC4gWFOBr4Wfg
TLSH
T134753359B592FE9EE4792B3F44424E3E446D53BECD690DA30749BCF8C0B9AB26E0501C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RDPCheck.exe
unpack001/RDPConf.exe
unpack001/RDPWInst.exe

File Explorer

RDPWrap-v1.6.2.zip

.zip 1.5MB
RDPCheck.exe

.exe 1021KB
RDPConf.exe

.exe 1.0MB
RDPWInst.exe

.exe 1.4MB
install.bat

458B
uninstall.bat

249B
update.bat

249B

RDPWrap-v1.6.2.zip

SHA256 35a9481ddbed5177431a9ea4bd09468fe987797d7b1231d64942d17eb54ec269
MD5 c26a2c5f6154225e8d83c4000306f162
SHA1 67c586cedbf0852aa52268311841cbac5c96fdf8
SHA512 d0977bd568d05c20ae3a099a3b9eb44c5ea379060d1470832be933ae98cb517b68509ac0f8679242984e64aef75dc5de5e65f094795fcdc881427ae475fe7c51
SSDEEP 49152:cPEbpqUPr0OMPjmNgyV24OXxr2/NV0CA7QUmu4LnB:cPEbpPPrC4gWFOBr4Wfg
TLSH
T134753359B592FE9EE4792B3F44424E3E446D53BECD690DA30749BCF8C0B9AB26E0501C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

RDPCheck.exe

IMPHASH 05a0d0ec656ffbcba1d60f4783a3f1d9
SHA256 5603338a1f8dbb46efb8e0869db3491d5db92f362711d6680f91ecc5d18bfadf
MD5 8f82226b2f24d470c02f6664f67f23f7
SHA1 66f40824b406c748846ef11e6b022958f8cbe48b
SHA512 04bc1f785bddf264699fb6bf6fce9652af8c95872f8fef93540f0b86df2e93ced910f01dc54a76a5425d2f5446d587df6ad20d8976fc4be7e9ce3511eb4b00ee
SSDEEP 12288:AR55BK3IsHoeGoE0SYmsjRwH/fD/sK3wzBOSdzIaVI99l/rk9gvQJg7:81KY2oeGTKRqPCBOSd0aVIHloI
TLSH
T136257C23B280273BC1274A39DD7B5274583BBE202E16585B6BF4394C3F367412DAA75B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

777468

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen GetErrorInfo GetActiveObject SysFreeString SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursorPos SetCursor SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PostQuitMessage PostMessageW PeekMessageA PeekMessageW OffsetRect MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessageTime GetMessagePos GetMessageExtraInfo GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CreateAcceleratorTableW CopyIcon ClientToScreen CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint AdjustWindowRectEx ActivateKeyboardLayout

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualFree VirtualAlloc TryEnterCriticalSection SwitchToThread SuspendThread SizeofResource SignalObjectAndWait SetThreadPriority SetThreadLocale SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReadFile RaiseException IsDebuggerPresent MultiByteToWideChar MulDiv LockResource LoadResource LoadLibraryW LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalSize GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVersionExW GetVersion GetUserDefaultLCID GetTickCount GetThreadPriority GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetExitCodeThread GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameW GetCPInfo FreeResource InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW EnumCalendarInfoW EnterCriticalSection DeleteCriticalSection CreateThread CreateFileW CreateEventW CompareStringW CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetMapMode SetEnhMetaFileBits SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SaveDC RoundRect RestoreDC Rectangle RectVisible RealizePalette Polyline Polygon PolyBezierTo PolyBezier PlayEnhMetaFile Pie PatBlt MoveToEx MaskBlt LineTo LPtoDP IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileDescriptionW GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontsW EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateEnhMetaFileW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW CloseEnhMetaFile Chord BitBlt Arc AbortDoc

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

CreateStreamOnHGlobal OleRegEnumVerbs IsAccelerator OleDraw OleSetMenuDescriptor OleUninitialize OleInitialize CoTaskMemFree ProgIDFromCLSID StringFromCLSID CoCreateInstance CoGetClassObject CoUninitialize CoInitialize IsEqualGUID IsEqualGUID

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_GetImageInfo ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Copy ImageList_LoadImageW ImageList_GetIcon ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_SetOverlayImage ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

Name

.text

Size

749KB

Virtual Size

749KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

806B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

176KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

RDPConf.exe

IMPHASH 401f49861c03e27b1837ef48b7fb06e2
SHA256 3c0e5d6863b03283afda9bd188501757d47dc57fc4bba2bdbb0d9baa34487fe0
MD5 03fb8e478f4ba100d37a136231fa2f78
SHA1 98685c37a6140701220c476449bee3f4e1fd28ef
SHA512 9d9052691c046e7268543b56c623ea2e9289f226b6c1f6449fbf5e2890f4b66d98e7bc312c663387d9f19d8f1b8b8959f9271fa0e2a51fc15791e29c49d908da
SSDEEP 24576:JwewFB5btX9uALSTRMab+wBySRX7ADs9UXOAPOA:At9UMSJADsaXOAPOA
TLSH
T182357D13B381133BC426523AD96792B05D3BBE202E964C57EFF4A94C1FF52A12C3A657
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

769144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegLoadKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegConnectRegistryW RegCloseKey QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursorPos SetCursor SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PostQuitMessage PostMessageW PeekMessageA PeekMessageW OffsetRect MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMessageExtraInfo GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClientRect GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumChildWindows EndPaint EndDeferWindowPos EnableWindow EnableScrollBar EnableMenuItem DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DeferWindowPos DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CreateAcceleratorTableW CopyIcon ClientToScreen CheckMenuItem CharUpperBuffW CharNextW CharLowerW CallWindowProcW CallNextHookEx BeginPaint BeginDeferWindowPos AdjustWindowRectEx ActivateKeyboardLayout

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualFree VirtualAlloc TryEnterCriticalSection SwitchToThread SuspendThread SizeofResource SignalObjectAndWait SetThreadPriority SetThreadLocale SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReadFile RaiseException IsDebuggerPresent MultiByteToWideChar MulDiv LockResource LoadResource LoadLibraryExW LoadLibraryW LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVersionExW GetVersion GetTickCount GetThreadPriority GetThreadLocale GetNativeSystemInfo GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCPInfo FreeResource InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW FindFirstFileW FindClose ExpandEnvironmentStringsW EnumCalendarInfoW EnterCriticalSection DeleteCriticalSection CreateThread CreateProcessW CreateFileW CreateEventW CompareStringW CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC Rectangle RectVisible RealizePalette Polyline Polygon PolyBezierTo PolyBezier Pie PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetTextMetricsW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontsW EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap Chord BitBlt Arc AbortDoc

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

OleUninitialize OleInitialize

comctl32

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

winsta

WinStationFreeMemory WinStationEnumerateW

Name

.text

Size

742KB

Virtual Size

742KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

670B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

232KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

RDPWInst.exe

IMPHASH a89655faa2b6840e801be1e1c779fc67
SHA256 ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
MD5 3288c284561055044c489567fd630ac2
SHA1 11ffeabbe42159e1365aa82463d8690c845ce7b7
SHA512 c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02
SSDEEP 24576:prKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:EHZ5pdqYH8ia6GcKuR7
TLSH
T1F0655C55F7E8403AD0A392388AB6A371D7BAB5841F30A6CF1164068E7F377E05E35399
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

276284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegLoadKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegConnectRegistryW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges StartServiceW QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW EnumServicesStatusExW

user32

LoadStringW MessageBoxA CharNextW MessageBoxW LoadStringW GetSystemMetrics CharUpperBuffW CharNextW

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW WriteFile WideCharToMultiByte WaitForSingleObject VirtualQueryEx VirtualQuery VirtualFree TerminateProcess Sleep SizeofResource SignalObjectAndWait SetFilePointer SetEvent SetEndOfFile ResetEvent RemoveDirectoryW ReadFile OpenProcess MultiByteToWideChar LockResource LoadResource LoadLibraryExW LeaveCriticalSection InitializeCriticalSection GetVersionExW GetThreadLocale GetNativeSystemInfo GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileAttributesW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentProcess GetCPInfo FreeResource InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW FindFirstFileW FindClose ExpandEnvironmentStringsW EnumCalendarInfoW EnterCriticalSection DeleteFileW DeleteCriticalSection CreateProcessW CreateFileW CreateEventW CreateDirectoryW CompareStringW CloseHandle Sleep

wininet

InternetReadFile InternetOpenUrlW InternetOpenW InternetCloseHandle

Name

.text

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

RDPWrap-v1.6.2.zip

RDPCheck.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

ole32

comctl32

winspool.drv

generic

RDPConf.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

ole32

comctl32

winspool.drv

winsta

generic

RDPWInst.exe

oleaut32

advapi32

user32

kernel32

wininet

generic

install.bat

uninstall.bat

update.bat