RED-Win64-Shipping[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RED-Win64-Shipping.exe
Size

176.7MB
MD5

6afdd2420b87b357019ccbd851564764
SHA1

f984d14148b2f8bafd2f84e781a0f7130486ee3f
SHA256

07b2bfd9a5f539757783124263a7b3ca989cfe2a90f15fe99bdaac0b96dc2b3b
SHA512

6b4aa796c016b83118fdd66cf529623da7239e8ff93dd421551dd79eb9b67283291ebc67baa91461ef289cd3e1f8b6ab03f834fa25f7a8875716a0a0b1e397b6
SSDEEP

3145728:sSWMyE0hhKpal1WadYFkPwz7gsLrIuamZ:D3yE0Sal1WwYFk+7gsPIuNZ

Score

N/A

Malware Config

Signatures

Files

RED-Win64-Shipping.exe
.exe windows x64

dd79666fbf76f58d223b6aa10427a8db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExW
RegCloseKey

api-ms-win-crt-convert-l1-1-0

_wcstoui64
_wtof
_wtoi
_wtoi64
strtoul
wcstod

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_errno

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_close
fclose
fopen_s
fread
fseek
ftell

api-ms-win-crt-string-l1-1-0

strncpy
towlower
wcsncpy
strncmp

api-ms-win-crt-utility-l1-1-0

rand
bsearch

gdi32

CreateFontIndirectA
DeleteObject
GetObjectA
GetStockObject
GetTextExtentPoint32W
PtInRegion
SelectObject
SetTextColor

kernel32

AttachConsole
CloseHandle
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FreeConsole
FreeLibrary
GetCommandLineW
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetThreadContext
GlobalAlloc
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
Process32First
Process32Next
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
RemoveDirectoryW
RtlVirtualUnwind
SetCriticalSectionSpinCount
SetFileAttributesW
SetThreadContext
SetThreadPriority
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcatW
lstrcmpiA
lstrcpyW
lstrlenA
lstrlenW

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

emp

EMP

opengl32

wglMakeCurrent
wglGetCurrentContext

shell32

CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteW

shlwapi

PathFileExistsW

user32

AdjustWindowRectEx
BeginPaint
CallWindowProcA
ClientToScreen
CloseClipboard
CreateWindowExA
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageA
DispatchMessageW
EmptyClipboard
EnableWindow
EndPaint
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetForegroundWindow
GetMessageA
GetMonitorInfoW
GetWindowInfo
GetWindowLongA
GetWindowLongPtrA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetWindowTextLengthW
GetWindowTextW
InvalidateRect
IsIconic
IsZoomed
LoadCursorA
LoadIconA
MessageBoxA
MessageBoxW
MonitorFromRect
MonitorFromWindow
OpenClipboard
PeekMessageW
PostQuitMessage
PtInRect
RegisterClassExW
RegisterRawInputDevices
ReleaseCapture
ReleaseDC
SendDlgItemMessageA
SendMessageA
SetCapture
SetClipboardData
SetCursor
SetWindowLongA
SetWindowLongPtrA
SetWindowPos
SetWindowRgn
SetWindowTextA
SetWindowTextW
ShowCursor
ShowWindow
TranslateMessage
UpdateWindow
WindowFromPoint
wsprintfW

vcruntime140

__std_exception_destroy
memmove
strchr
strstr
wcsstr
__std_exception_copy

wininet

HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetQueryOptionA
InternetReadFile
InternetSetOptionA

ws2_32

accept
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
bind
sendto
setsockopt
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
freeaddrinfo
getaddrinfo

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
agsDeInit
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_DeInit
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_Init
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsGetCrossfireGPUCount
agsInit
agsSetDisplayMode
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.edata
Size: 43.1MB - Virtual size: 43.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 13.0MB - Virtual size: 13.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sdata
Size: 638KB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.link
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.trace
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data1
Size: 117.5MB - Virtual size: 117.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sbss
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xpdata
Size: 457KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd79666fbf76f58d223b6aa10427a8db

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

gdi32

kernel32

msvcp140

emp

opengl32

shell32

shlwapi

user32

vcruntime140

wininet

ws2_32

Exports

Exports

Sections

.edata Size: 43.1MB - Virtual size: 43.1MB

.tls Size: 13.0MB - Virtual size: 13.0MB

.sdata Size: 638KB - Virtual size: 8.0MB

.pdata Size: 2.0MB - Virtual size: 2.0MB

.link Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.trace Size: 32KB - Virtual size: 32KB

.data1 Size: 117.5MB - Virtual size: 117.5MB

.rdata Size: 35KB - Virtual size: 35KB

.text Size: 4KB - Virtual size: 3KB

.sbss Size: 11KB - Virtual size: 10KB

.xpdata Size: 457KB - Virtual size: 457KB

.edata
Size: 43.1MB - Virtual size: 43.1MB

.tls
Size: 13.0MB - Virtual size: 13.0MB

.sdata
Size: 638KB - Virtual size: 8.0MB

.pdata
Size: 2.0MB - Virtual size: 2.0MB

.link
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.trace
Size: 32KB - Virtual size: 32KB

.data1
Size: 117.5MB - Virtual size: 117.5MB

.rdata
Size: 35KB - Virtual size: 35KB

.text
Size: 4KB - Virtual size: 3KB

.sbss
Size: 11KB - Virtual size: 10KB

.xpdata
Size: 457KB - Virtual size: 457KB