RedEagle[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

RedEagle.rar
Size

590KB
MD5

91e9da90a7ce496d67a13863766562ab
SHA1

0ef941eb9ab0e1d732b6853d04ab808b66a0b5e5
SHA256

9649b99a99df8ebfa3f0832480b991ae6de73cb393b9cab4aed1d00c5f31234a
SHA512

d07090ae9a9a773a442cbc1f8434ca5ff67bfe1d5b1be5262f3df637acfaaeb6f86a99d96256afb0f126da573ba2e730e7b934619ae352d317477ea6bd0691fe
SSDEEP

12288:nn6kARweitjNF/zJv6T1yqtAYl/uWmR37TLj0FKRQUPNZbF7zpwvmbm:nnOfiBNNdv6ZL+Yl/uDjMQQUPNxF7u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RedEagle.exe

Files

RedEagle.rar
.rar
RedEagle.exe
.exe windows:6 windows x64 arch:x64

c80a6d9f7eb975886f5e9e4a96e80417

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Hassan\Desktop\FiveM-ExternalCheat-main\x64\Release\CFramework.pdb

Imports

kernel32

GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
CreateToolhelp32Snapshot
CloseHandle
Module32Next
OpenProcess
GetFileSizeEx
ReadFile
HeapAlloc
HeapFree
MapViewOfFile
MultiByteToWideChar
GlobalUnlock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
K32GetModuleBaseNameA
ReadProcessMemory
WideCharToMultiByte
GlobalLock
GlobalFree
CreateFileMappingA
GlobalAlloc
Sleep
UnmapViewOfFile
WriteProcessMemory
CreateFileA

user32

GetWindowLongA
GetAsyncKeyState
PeekMessageA
TranslateMessage
SetProcessDpiAwarenessContext
DestroyWindow
SetWindowDisplayAffinity
DefWindowProcA
CreateWindowExA
SetWindowPos
ShowWindow
DispatchMessageA
SetWindowLongA
SetLayeredWindowAttributes
GetWindowDisplayAffinity
UnregisterClassA
PostQuitMessage
FindWindowA
RegisterClassExA
UpdateWindow
SetForegroundWindow
GetKeyState
GetMessageExtraInfo
LoadCursorA
ScreenToClient
GetCapture
MessageBoxA
GetWindowThreadProcessId
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
ClientToScreen
TrackMouseEvent

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__intrinsic_setjmp
__C_specific_handler
__current_exception_context
__current_exception
memcmp
memchr
memset
memmove
memcpy
longjmp
strrchr
strstr
__std_terminate
__std_exception_destroy
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_c_exit
_seh_filter_exe
_exit
_register_thread_local_exe_atexit_callback
exit
_initialize_onexit_table
_initterm_e
_set_app_type
_get_narrow_winmain_command_line
_initterm
_beginthreadex
terminate
_cexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

fflush
ftell
__stdio_common_vfprintf
__acrt_iob_func
fseek
_wfopen
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
_set_fmode
fclose
__p__commode
fwrite

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp
strncpy
strncmp

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

atof
strtol

api-ms-win-crt-math-l1-1-0

cosf
__setusermatherr
fmodf
sqrtf
ceilf
acosf
powf
sinf
atan2f

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 776KB - Virtual size: 775KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c80a6d9f7eb975886f5e9e4a96e80417

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

imm32

d3dcompiler_47

dwmapi

d3d11

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 776KB - Virtual size: 775KB

.rdata Size: 321KB - Virtual size: 320KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 37KB - Virtual size: 36KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 776KB - Virtual size: 775KB

.rdata
Size: 321KB - Virtual size: 320KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 37KB - Virtual size: 36KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB