Gridinsoft Logo
File Icon

RDPConf.exe Risk RemoteAdmin Analysis

Updated 1 year ago
Checked by Malware Check
RDPConf.exe

Technical Analysis

File Name RDPConf.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.167.174
Database Version 2024-02-23 13:00:12 UTC
⚠

Risk.Win32.RemoteAdmin.cc

Malware family: RemoteAdmin

RemoteAdmin tools provide legitimate remote system management capabilities but can be exploited by threat actors for unauthorized access and control over victim systems.
N/A
Detection Rate
1,096,192
File Size (bytes)
2024-02-23
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
03fb8e478f4ba100d37a136231fa2f78
SHA1
98685c37a6140701220c476449bee3f4e1fd28ef
SHA256
3c0e5d6863b03283afda9bd188501757d47dc57fc4bba2bdbb0d9baa34487fe0
SHA512
9d9052691c046e7268543b56c623ea2e9289f226b6c1f6449fbf5e2890f4b66d98e7bc312c663387d9f19d8f1b8b8959f9271fa0e2a51fc15791e29c49d908da
ImpHash
401f49861c03e27b1837ef48b7fb06e2

PE Analysis

Basic Information

▼
Icon
Hash: a40fbc48f75ba98c220204d766fc0e80
Fuzzy: 41eb8e76fb90eb3386be79564fa26965
dHash: f2d3c3c3c7e0b0d8
Image Base 0x00400000
Entry Point 0x004bbc78
Compilation Time 2017-12-27 18:29:54
Checksum 0x00000000 (Actual: 0x0010f4de)
OS Version 5.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 11 libraries
Exports 0 functions
Resources 61 Resources
Sections 10 Sections

Version Information

▼
CompanyName Stas'M Corp.
FileDescription RDP Configuration Program
FileVersion 1.4.0.0
InternalName RDPConf
LegalCopyright Copyright © Stas'M Corp. 2017
LegalTrademarks Stas'M Corp.
OriginalFilename RDPConf.exe
ProductName RDP Host Support
ProductVersion 1.6.2.0
Comments http://stascorp.com
Translation 0x0409 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 759,916 bytes 760,320 bytes 6.44 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 129E3FAE9E85C88E7AE019FD6457650D
.itext 0x000bb000 3,384 bytes 3,584 bytes 5.99 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 97628668C98F466236A46589DCF119AF
.data 0x000bc000 9,264 bytes 9,728 bytes 3.95 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 735B7BF7A3442CE46ACAAD3C11459C71
.bss 0x000bf000 21,236 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.idata 0x000c5000 12,760 bytes 12,800 bytes 5.03 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E2D0EC8B50B85414A4C43840636FA0A9
.didata 0x000c9000 670 bytes 1,024 bytes 2.91 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C7EDB419FA902391E94D5E75BE8860D8
.tls 0x000ca000 60 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x000cb000 24 bytes 512 bytes 0.21 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ DC1B7E655B1F90A291D2062B840F6F13
.reloc 0x000cc000 69,396 bytes 69,632 bytes 6.69 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D0CC471D68E85588DE853A31D692812C
.rsrc 0x000dd000 237,568 bytes 237,568 bytes 6.38 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 22FCBC689257DB568064E95138583AB7
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 61 (233,982 bytes)
Resource Type Count Total Size Percentage
RT_CURSOR 7 2,156 bytes
0.9%
RT_BITMAP 12 4,964 bytes
2.1%
RT_ICON 9 164,316 bytes
70.2%
RT_STRING 16 10,636 bytes
4.5%
RT_RCDATA 6 49,049 bytes
21%
RT_GROUP_CURSOR 7 140 bytes
0.1%
RT_GROUP_ICON 1 132 bytes
0.1%
RT_VERSION 1 880 bytes
0.4%
RT_MANIFEST 2 1,709 bytes
0.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Risk.Win32.RemoteAdmin.cc Removal

Gridinsoft has the capability to identify and eliminate Risk.Win32.RemoteAdmin.cc without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware