RED-Win64-Shipping[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

RED-Win64-Shipping.exe
Size

177.4MB
MD5

a0c190bb00775e492cca64e1d78a17ab
SHA1

68075c130cca8697f5e12570e3fcbfcd1d6d620b
SHA256

6caf1b5a7b2c444a33a0a58841fafe5e6bc325ca560d780cb595cf445b7d4a3f
SHA512

2efb7c9ca0f747cf278ca789a7ca12ee553157fee2e1587cb78902358ab6a805dae32671051b17974c9f9de18260a5b8de41baf7bfe77a04dc83fe1d902b11c6
SSDEEP

1572864:pyMambhk5+0mhoMVZ4ekgFiTbMyqJIe/M/RRtZSfhbi9uvbRmFnlZeN5HiVjTzoB:UFDZwfNicp3k/RRtZSfg9ubRIGe2+KZ

Score

1^/10

Malware Config

Signatures

Files

RED-Win64-Shipping.exe
.exe windows x64

4e1733d97115b968c66b34501de071a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExW
RegCloseKey

api-ms-win-crt-convert-l1-1-0

_wcstoui64
_wtof
_wtoi
_wtoi64
strtoul
wcstod

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_errno

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_close
fclose
fopen_s
fread
fseek
ftell

api-ms-win-crt-string-l1-1-0

strncpy
towlower
wcsncpy
strncmp

api-ms-win-crt-utility-l1-1-0

rand
bsearch

gdi32

CreateFontIndirectA
DeleteObject
GetObjectA
GetStockObject
GetTextExtentPoint32W
PtInRegion
SelectObject
SetTextColor

kernel32

AttachConsole
CloseHandle
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FreeConsole
FreeLibrary
GetCommandLineW
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetThreadContext
GlobalAlloc
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
Process32First
Process32Next
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
RemoveDirectoryW
RtlVirtualUnwind
SetCriticalSectionSpinCount
SetFileAttributesW
SetThreadContext
SetThreadPriority
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcatW
lstrcmpiA
lstrcpyW
lstrlenA
lstrlenW

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

ole32

CoTaskMemFree

opengl32

wglMakeCurrent
wglGetCurrentContext

shell32

CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteW

emp

EMP

user32

AdjustWindowRectEx
BeginPaint
CallWindowProcA
ClientToScreen
CloseClipboard
CreateWindowExA
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageA
DispatchMessageW
EmptyClipboard
EnableWindow
EndPaint
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetForegroundWindow
GetMessageA
GetMonitorInfoW
GetWindowInfo
GetWindowLongA
GetWindowLongPtrA
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetWindowTextLengthW
GetWindowTextW
InvalidateRect
IsIconic
IsZoomed
LoadCursorA
LoadIconA
MessageBoxA
MessageBoxW
MonitorFromRect
MonitorFromWindow
OpenClipboard
PeekMessageW
PostQuitMessage
PtInRect
RegisterClassExW
RegisterRawInputDevices
ReleaseCapture
ReleaseDC
SendDlgItemMessageA
SendMessageA
SetCapture
SetClipboardData
SetCursor
SetWindowLongA
SetWindowLongPtrA
SetWindowPos
SetWindowRgn
SetWindowTextA
SetWindowTextW
ShowCursor
ShowWindow
TranslateMessage
UpdateWindow
WindowFromPoint
wsprintfW

vcruntime140

__std_exception_destroy
memmove
strchr
strstr
wcsstr
__std_exception_copy

wininet

HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetQueryOptionA
InternetReadFile
InternetSetOptionA

ws2_32

accept
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
bind
sendto
setsockopt
closesocket
connect
getpeername
getsockname
getsockopt
htonl
htons
freeaddrinfo
getaddrinfo

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
agsDeInit
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_DeInit
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_Init
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsGetCrossfireGPUCount
agsInit
agsSetDisplayMode
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.arch
Size: 43.1MB - Virtual size: 43.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xtls
Size: 12.9MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.srdata
Size: 638KB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.text1
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata
Size: 118.2MB - Virtual size: 118.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xpdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xcode
Size: 457KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e1733d97115b968c66b34501de071a3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

gdi32

kernel32

msvcp140

ole32

opengl32

shell32

emp

user32

vcruntime140

wininet

ws2_32

Exports

Exports

Sections

.arch Size: 43.1MB - Virtual size: 43.1MB

.xtls Size: 12.9MB - Virtual size: 12.9MB

.srdata Size: 638KB - Virtual size: 8.0MB

.pdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 512B - Virtual size: 4KB

.idata Size: 512B - Virtual size: 4KB

.text1 Size: 32KB - Virtual size: 32KB

.rdata Size: 118.2MB - Virtual size: 118.2MB

.xpdata Size: 35KB - Virtual size: 35KB

.tls Size: 3KB - Virtual size: 2KB

.xdata Size: 11KB - Virtual size: 10KB

.xcode Size: 457KB - Virtual size: 457KB

.arch
Size: 43.1MB - Virtual size: 43.1MB

.xtls
Size: 12.9MB - Virtual size: 12.9MB

.srdata
Size: 638KB - Virtual size: 8.0MB

.pdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 512B - Virtual size: 4KB

.text1
Size: 32KB - Virtual size: 32KB

.rdata
Size: 118.2MB - Virtual size: 118.2MB

.xpdata
Size: 35KB - Virtual size: 35KB

.tls
Size: 3KB - Virtual size: 2KB

.xdata
Size: 11KB - Virtual size: 10KB

.xcode
Size: 457KB - Virtual size: 457KB