rd[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rd.exe
Size 23.1MB
Sample260705-ankyyabs5j
SHA256 43a9b0cd46afe1944d0010849cf3a90fc474d73b13359acc984b766404fbea37
MD5 50d6d12089283ff079c8a1f1d5aa5042
SHA1 6da240e691f522b0a13b082cd21f005cd090e8f4
SHA512 94c5ca92d4f4fe87a4c053ad67f5149be2b86eab4527d9b376d426c463d0501173ea69485887d445cddd70533db19228a2af9d6c9ca08fb1be23fe68ba817b9e
SSDEEP 393216:IGza0BvmFbLeDUfij6KBOo30O2Pa6GUrpLnQ8Qvg4T9goDaili6ZXOYRw:IevtUqZkokOr6GUrWvFfVjZXOYK
TLSH
T1A7373315F3940AACF42B84718A1256B3A6753CBA17249DE729C433653F3DAE42F3B364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

rd.exe

.exe 23.1MB

rd.exe

IMPHASH 1728f5830d9188240379efd54db72133
SHA256 43a9b0cd46afe1944d0010849cf3a90fc474d73b13359acc984b766404fbea37
MD5 50d6d12089283ff079c8a1f1d5aa5042
SHA1 6da240e691f522b0a13b082cd21f005cd090e8f4
SHA512 94c5ca92d4f4fe87a4c053ad67f5149be2b86eab4527d9b376d426c463d0501173ea69485887d445cddd70533db19228a2af9d6c9ca08fb1be23fe68ba817b9e
SSDEEP 393216:IGza0BvmFbLeDUfij6KBOo30O2Pa6GUrpLnQ8Qvg4T9goDaili6ZXOYRw:IevtUqZkokOr6GUrWvFfVjZXOYK
TLSH
T1A7373315F3940AACF42B84718A1256B3A6753CBA17249DE729C433653F3DAE42F3B364
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

57:3d:2c:24:d1:81:85:16:ff:ff:57:ba:ba:03:d6:19:63:d2:c7:e9:21:0c:a6:35:87:5a:73:61:e3:aa:cd:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Huabing Zhou,O=Open Source Developer,L=Singapore,C=SG

Chains

Jan 9, 2026

CN=Open Source Developer\, Huabing Zhou,O=Open Source Developer,L=Singapore,C=SG

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Open Source Developer\, Huabing Zhou,O=Open Source Developer,L=Singapore,C=SG

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Open Source Developer\, Huabing Zhou,O=Open Source Developer,L=Singapore,C=SG

Serial Number

2e:ae:54:8c:2e:5c:6b:3c:df:39:e0:48:ec:1f:d9:0f

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 19, 2026

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2025,O=Asseco Data Systems S.A.,C=PL

Serial Number

9e:9c:04:f6:55:a8:b4:a7:02:6d:49:8c:6c:78:8d:aa

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 7, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

306424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcessHeap HeapAlloc FormatMessageW GetTempPathW GetTempFileNameW CreateActCtxW ActivateActCtx DeleteFileW HeapSize GetModuleHandleW LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetProcAddress FlsFree FlushFileBuffers AddVectoredExceptionHandler SetThreadStackGuarantee GetConsoleOutputCP HeapReAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive FlsSetValue FlsGetValue FlsAlloc GetCommandLineW lstrlenW GetProcessId GetFileInformationByHandleEx WaitForMultipleObjects GetOverlappedResult WaitForSingleObject GetExitCodeProcess CopyFileExW AcquireSRWLockShared ReleaseSRWLockShared GetStringTypeW DuplicateHandle GetFileType SetStdHandle SetEnvironmentVariableW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetWindowsDirectoryW GetCommandLineA GetModuleHandleExW TerminateProcess ExitProcess WriteFile RtlPcToFileHeader LoadLibraryExW TlsFree GetSystemDirectoryW QueryPerformanceCounter Sleep TlsSetValue QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer TlsGetValue GetModuleHandleA GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode TlsAlloc MultiByteToWideChar WriteConsoleW GetCurrentProcess GetEnvironmentVariableW GetModuleFileNameW CreateFileW GetFileInformationByHandle InitializeCriticalSectionAndSpinCount GetFullPathNameW CreateDirectoryW FindFirstFileW FindClose GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList SetLastError GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx SetFilePointerEx CreateEventW CancelIo ReadFile GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx LoadLibraryA ReleaseMutex RtlVirtualUnwind SetFileInformationByHandle SwitchToThread DeleteCriticalSection LeaveCriticalSection HeapFree EnterCriticalSection RaiseException CloseHandle GetLastError GetSystemTimeAsFileTime FreeLibrary EncodePointer GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx

ntdll

RtlGetVersion NtCreateFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoInitialize CoCreateInstance CoTaskMemFree

comctl32

SetWindowSubclass GetWindowSubclass InitCommonControlsEx DefSubclassProc RemoveWindowSubclass

user32

GetDC GetMenuItemCount DestroyMenu DefWindowProcW ShowWindow DispatchMessageW DestroyWindow ReleaseDC DeleteMenu GetAncestor GetMessageW GetMenuItemID GetSubMenu GetClassNameW AllowSetForegroundWindow GetParent SetParent SendMessageW PostMessageW EnumChildWindows SetWindowPos IsWindow GetMonitorInfoW MonitorFromWindow AdjustWindowRectEx CreateWindowExW RegisterClassExW LoadCursorW SendNotifyMessageW GetClientRect IsDialogMessageW TranslateMessage

gdi32

DeleteObject CreateDIBSection CreateSolidBrush

shell32

SHGetKnownFolderPath DragFinish

shlwapi

SHCreateMemStream

windowscodecs

WICConvertBitmapSource

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22.6MB

Virtual Size

22.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rd.exe

kernel32

ntdll

ole32

comctl32

user32

gdi32

shell32

shlwapi

windowscodecs

bcrypt

advapi32

generic