Red Giant Link[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Red Giant Link.exe
Size

407KB
MD5

c57ed4aa07fb1adfc383748192a4ddd3
SHA1

ae33cb51587192eb1e81fa214bd75e640a6fa2d1
SHA256

06053edb9be34213ceb4c6ed68fb1a3f9728c52a5136dab4f003a7b90cf31375
SHA512

6b2b886ce0ee5e9519cd8456ff3ca27fa30341c4014572f94faf4bd6c5243ec1551d2274ed184948e4e70456eb3ffca14d3c671b439f0f4beaf7f0459a1a295a
SSDEEP

3072:MDEdeNcXVL/72cKqJhEmlAZuTXBhxyzDx77HB6PJR8KS+UyOO:MKjXZTXBhxyzl/HB6PP8Kqa

Score

1^/10

Malware Config

Signatures

Files

Red Giant Link.exe
.exe windows:5 windows x64 arch:x64

3296551129c22a122b1f212f996cc3e1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:90:ab:bb
Certificate

Issuer

CN=XRamp Global Certification Authority,OU=www.xrampsecurity.com,O=XRamp Security Services Inc,C=US

Not Before

22/12/2008, 23:47

Not After

22/12/2028, 23:47

Subject

CN=Trustwave Code Signing CA\, Level 2,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:4e:ad:39:6c:dc:f0:53:e5:df:d9:28:d0:1e:79:8e:35:8d:54
Certificate

Issuer

CN=Trustwave Code Signing CA\, Level 2,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Not Before

28/07/2014, 15:09

Not After

26/09/2016, 21:09

Subject

CN=Red Giant LLC,O=Red Giant LLC,L=Beaverton,ST=OR,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

51:98:28:d3:9a:4d:08:83:50:6d:58:37:c0:52:03:fc:7c:5d:f9:64
Signer

Actual PE Digest

51:98:28:d3:9a:4d:08:83:50:6d:58:37:c0:52:03:fc:7c:5d:f9:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetFocus
MessageBoxA

msvcr90

__set_app_type
?terminate@@YAXXZ
_encode_pointer
__dllonexit
_strdup
_onexit
_decode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_amsg_exit
realloc
bsearch
qsort
memcpy
memset
fprintf
__iob_func
setbuf
getenv
atoi
malloc
free
strncmp
strrchr
__argv
__argc
strncpy
_snprintf
_stricmp
_unlock
_lock

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
Sleep
HeapAlloc
IsBadReadPtr
SetLastError
GetProcessHeap
HeapFree
VirtualFree
VirtualProtect
VirtualAlloc
FreeLibrary
GetModuleHandleA
OutputDebugStringA
GetFullPathNameA
LoadLibraryA
GetProcAddress
UnmapViewOfFile
CreateFileA
GetFileSize
CreateFileMappingA
CloseHandle
MapViewOfFile
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetLastError
FormatMessageA
LocalFree
lstrlenA
GetCurrentProcessId

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3296551129c22a122b1f212f996cc3e1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

41:90:ab:bbCertificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

06:4e:ad:39:6c:dc:f0:53:e5:df:d9:28:d0:1e:79:8e:35:8d:54Certificate

Extended Key Usages

Key Usages

51:98:28:d3:9a:4d:08:83:50:6d:58:37:c0:52:03:fc:7c:5d:f9:64Signer

Headers

DLL Characteristics

File Characteristics

Imports

user32

msvcr90

kernel32

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 381KB - Virtual size: 381KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

41:90:ab:bb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

06:4e:ad:39:6c:dc:f0:53:e5:df:d9:28:d0:1e:79:8e:35:8d:54
Certificate

51:98:28:d3:9a:4d:08:83:50:6d:58:37:c0:52:03:fc:7c:5d:f9:64
Signer

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 381KB - Virtual size: 381KB