File scan report
Verdict Safe
Is RDPWrap
None of the 71 antivirus engines that checked it flagged this validly signed Remote Desktop utility installer, and four sandbox runs recorded ordinary installer activity with a…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer appears safe to use when obtained from the project's official release page. Keep your antivirus enabled during installation.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing CpdX4, LLC
- Test run Completed
- First seen 8d ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine in our network flagged this installer, and its signature from CpdX4, LLC verifies. In four sandbox runs it unpacked a standard setup program, wrote a log file and queried GitHub for the latest release. The combined sandbox verdict was clean, with no high-risk techniques observed.
The file carries a valid signature from CpdX4, LLC, a publisher with no prior history in our records. Across four sandbox runs, the combined verdict was clean, and the only notable network activity was a request to GitHub's API for the latest release. The antivirus analysis notes a code protector, which is common in small commercial tools and is not corroborated by any hostile evidence. Files built with the same import table show mixed past results, but they come from unrelated publishers and say little about this one.
What We Detected
None of the 71 antivirus engines that checked it flagged this installer, and every major antivirus engine reported it clean. Its code signature from CpdX4, LLC verifies. No public malware database or community rule lists this file, which was first seen on Oct 17, 2026.
Threat Behavior
In four sandbox runs the installer extracted a standard setup program and helper files to a temporary folder. It also wrote an installation log and contacted GitHub's API to check for the latest release. No process injection target, persistence mechanism or high-risk technique was recorded, and the combined sandbox verdict was clean. The antivirus analysis reports a .NET code protector, which makes the code harder to read but is not malicious in itself.
What To Do Now
Download this tool only from its official project page. Be aware that Remote Desktop session tools change Windows system components, which some workplaces do not allow. Keep your antivirus enabled during installation.
Where this verdict could be wrong3 caveats
- The installer carries a .NET Reactor protector, which hides code from inspection, though no engine or sandbox run found anything hostile.
- The publisher has no history with us, and the file was first seen on Oct 17, 2026, so its reputation is still thin.
- Tools that enable extra Remote Desktop sessions modify Windows system components, which some organisations prohibit by policy.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file.
- The code signature from CpdX4, LLC verifies.
- Four sandbox runs showed ordinary installer activity with a clean combined verdict.
- No public malware database or community rule lists this file.
- The code is wrapped in a protector that hinders inspection.
- The signing publisher has no history in our records.
7 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 13sandbox rule tags
- 5spawned processes
- 3network contacts
- 11filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1497· Sandbox evasion
- T1553
- T1553.002
- T1573
- T1574· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
RDPWrapKit-Setup.exe"C:\Users\<USER>\Desktop\RDPWrapKit-Setup.exe"RDPWrapKit-Setup.tmp"C:\Users\<USER>\AppData\Local\Temp\is-6B2GRV88RB.tmp\RDPWrapKit-Setup.tmp" /SL5="$18005A,1571790,1370624,C:\Users\<USER>\Desktop\RDPWrapKit-Setup.exe"d1d4fb691cd93e61fa8f073760497b6d4699ff3be848df95d9052766b2d6cc23.exeC:\Users\<USER>\AppData\Local\Temp\is-E61XTEHZH5.tmp\d1d4fb691cd93e61fa8f073760497b6d4699ff3be848df95d9052766b2d6cc23.tmp /SL5=$201A0,1571790,1370624,C:\Users\<USER>\Downloads\d1d4fb691cd93e61fa8f073760497b6d4699ff3be848df95d9052766b2d6cc23.exeRDPWrapKit-Setup.exe"C:\Users\user\Desktop\RDPWrapKit-Setup.exe"RDPWrapKit-Setup.tmp"C:\Users\user\AppData\Local\Temp\is-790C3LCKHZ.tmp\RDPWrapKit-Setup.tmp" /SL5="$104A4,1571790,1370624,C:\Users\user\Desktop\RDPWrapKit-Setup.exe"
Network contacts
33 hosts, listed as 1 domain, 2 addresses, 1 link. Links show the host and path only.
- Domain
api.github.com - IP address
140.82.113.5 - IP address
140.82.114.5 - URL
https://api.github.com/repos/cpdx4/RDPWrapKit/releases/latest
Files
9Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-6B2GRV88RB.tmp\RDPWrapKit-Setup.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-E61XTEHZH5.tmp\d1d4fb691cd93e61fa8f073760497b6d4699ff3be848df95d9052766b2d6cc23.tmp - Written
C:\ProgramData\RDPWrapKit\Logs\RDPWrapKit_install_20261023-085853.log - Written
C:\Users\<USER>\AppData\Local\Temp\is-9OP5RGKYFU.tmp\RdpSignTool.exe - Written
C:\Users\<USER>\AppData\Local\Temp\is-9OP5RGKYFU.tmp\RDPWrapKitIcon.bmp - Written
C:\Users\user\AppData\Local\Temp\is-790C3LCKHZ.tmp
Show all 9 entries for files
- Written
C:\Users\user\AppData\Local\Temp\is-790C3LCKHZ.tmp\RDPWrapKit-Setup.tmp - Written
C:\Users\user\AppData\Local\Temp\is-GL1ST678ZC.tmp - Written
C:\Users\user\AppData\Local\Temp\is-GL1ST678ZC.tmp\_isetup
Registry and auto-start
6Settings the file changed, including ways to start again after a restart.
- Set
Software\Microsoft\RestartManager\Session0000\Owner - Set
Software\Microsoft\RestartManager\Session0000\SessionHash - Set
Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
Show all 7 entries for sandbox background — not the file
- VM host
8.8.8.8
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 2998c4ac2fd63157a5bc…1d55fbNot checkedno saved verdict
- 1804085dc14322b26f49…764acdNot checkedno saved verdict
- 3910b2acdd0b39e16235…a18ab2Not checkedno saved verdict
- 09f2e0b8d5f2ac607f54…3003b8Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by CpdX4, LLC.
Sources checked
Every check behind this verdict
7 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 25, 2026, 2:44 PM UTC
- SHA-256
d1d4fb691cd93e61fa8f073760497b6d4699ff3be848df95d9052766b2d6cc23- SHA-1
2e612d84e70eca5a0fd8cb451abd65e96b0dc6af- MD5
4de78519eb9d67bab6ae6dcaa2f6406b
About this file
RDPWrapKit-Setup.exe is a Win32 EXE file of 3.6 MB.
- Claims to be
- RDPWrapKit Setup (RDPWrapKit)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 3.6 MB
- Signer
- CpdX4, LLCValid code signature.
- First seen
- Oct 17, 2026On VirusTotal.
- Submitted by
- 88 distinct sources
- Packer
- .NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
- Entropy
- 7.02 of 8
First scanned
Verdict history
- Not fully confirmed
- Safeafter the analysis was completed
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is RDPWrapKit-Setup.exe safe?
What is RDPWrapKit-Setup.exe?
How many antivirus engines detected RDPWrapKit-Setup.exe?
Is RDPWrapKit-Setup.exe digitally signed?
What is the SHA-256 hash of RDPWrapKit-Setup.exe?
Is it safe to install RDPWrapKit-Setup.exe?
How up to date is this analysis of RDPWrapKit-Setup.exe?
Community
Member reviews and reports for this exact file hash.