popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

RDPConf.exe

Generic Malware Malicious Library UPX PE32 PE File MZP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 25, 2024, 10:38 a.m. Oct. 25, 2024, 10:42 a.m.
Size 1.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 03fb8e478f4ba100d37a136231fa2f78
SHA256 3c0e5d6863b03283afda9bd188501757d47dc57fc4bba2bdbb0d9baa34487fe0
CRC32 29DD63D6
ssdeep 24576:JwewFB5btX9uALSTRMab+wBySRX7ADs9UXOAPOA:At9UMSJADsaXOAPOA
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .itext
section .didata
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
rdpconf+0x447b5 @ 0x4447b5
rdpconf+0x44504 @ 0x444504
rdpconf+0xb5a9b @ 0x4b5a9b
rdpconf+0xa0933 @ 0x4a0933
rdpconf+0xa0908 @ 0x4a0908
rdpconf+0xab129 @ 0x4ab129
rdpconf+0xbbcbe @ 0x4bbcbe
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1637772
registers.edi: 1637944
registers.eax: 1637772
registers.ebp: 1637852
registers.edx: 0
registers.ebx: 6656360
registers.esi: 4933056
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00670000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Lionic Riskware.Win32.RDPWrap.1!c
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.Infected.th
ALYac Misc.Riskware.RemoteAdmin
Cylance Unsafe
Sangfor Trojan.Win32.RemoteAdmin.AN
K7GW RemoteTool ( 0053f8421 )
K7AntiVirus RemoteTool ( 0053f8421 )
ClamAV Win.Trojan.Agent-6645876-0
Kaspersky not-a-virus:RemoteAdmin.Win32.RDPWrap.b
Alibaba RiskWare:Win32/RDPWrap.c34730b7
Rising Malware.Undefined!8.C (C64:YzY0OqssLIp/7y4i)
F-Secure PrivacyRisk.SPR/RemoteAdmin.AN
DrWeb Program.Rdpwrap.12
Zillya Tool.RDPWrap.Win32.10
TrendMicro HackTool.Win32.Radmin.HA
McAfeeD ti!3C0E5D6863B0
CTX exe.remote-access-trojan.rdpwrap
Sophos RDPWrap (PUA)
Jiangmin RemoteAdmin.RDPWrap.b
Google Detected
Avira SPR/RemoteAdmin.AN
Antiy-AVL RiskWare[RemoteAdmin]/Win32.RDPWrap
Gridinsoft Risk.Win32.RemoteAdmin.cc
ViRobot NetTool.RemoteApp.1096192
ZoneAlarm not-a-virus:RemoteAdmin.Win32.RDPWrap.b
Varist W32/ABApplication.KVPF-3661
AhnLab-V3 Unwanted/Win32.Rdpwrap.C2632304
McAfee RemAdm-RemoteAdmin.p
DeepInstinct MALICIOUS
Malwarebytes Neshta.Virus.FileInfector.DDS
Panda PUP/RemoteAdmin
Zoner Trojan.Win32.99281
TrendMicro-HouseCall HackTool.Win32.Radmin.HA
Tencent Malware.Win32.Gencirc.10bded39
MaxSecure Trojan.Malware.10885958.susgen
alibabacloud Backdoor[rat]:Win/RDPWrap.b