Redware[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Redware.exe
Size 45.9MB
Sample260810-zebrcaxgrd
SHA256 51ec75d8e469a1a4bd388946823b4ace51ee06e908d085acb72aaefcc77d72a4
MD5 f38a6c4f2178000059a49d28027d2618
SHA1 8dd8836817a8f106c1182818f2f235bcf64de208
SHA512 3cebf86b7c9797a7c5eb341f49259ba7fc88d6366b8fd27e69c4cab570cb263ceeb6cfa5f94c93fafaa90ee0e9ff3f63312e0696a6fb080bb5a4be70a0f2afde
SSDEEP 786432:JhbUIP2Yom3C2l7qNz4HeqEeNP20F3Ua44gTat5QH5b0ZeAk8A1w1AVKE/uIyLfI:fP2YoQC2896d3P20V44gTY6HyvAJi3TI
TLSH
T145B7339F9AE693D9C8830964364A07DA35C5E49CC8FD59382FCB2C026534CBF468DA77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Redware.exe

File Explorer

Redware.exe

.exe 45.9MB

Redware.exe

IMPHASH 636bb1508d7a5d9af1a58b76f7202d99
SHA256 51ec75d8e469a1a4bd388946823b4ace51ee06e908d085acb72aaefcc77d72a4
MD5 f38a6c4f2178000059a49d28027d2618
SHA1 8dd8836817a8f106c1182818f2f235bcf64de208
SHA512 3cebf86b7c9797a7c5eb341f49259ba7fc88d6366b8fd27e69c4cab570cb263ceeb6cfa5f94c93fafaa90ee0e9ff3f63312e0696a6fb080bb5a4be70a0f2afde
SSDEEP 786432:JhbUIP2Yom3C2l7qNz4HeqEeNP20F3Ua44gTat5QH5b0ZeAk8A1w1AVKE/uIyLfI:fP2YoQC2896d3P20V44gTY6HyvAJi3TI
TLSH
T145B7339F9AE693D9C8830964364A07DA35C5E49CC8FD59382FCB2C026534CBF468DA77
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82862694

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

ws2_32

WSACloseEvent

crypt32

CertFreeCertificateContext

setupapi

SetupDiDestroyDeviceInfoList

bcrypt

BCryptGetProperty

kernel32

OpenProcess GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

GetCursorPos

gdi32

BitBlt

advapi32

AddAccessDeniedAce

shell32

SHGetPathFromIDListA

ole32

CoTaskMemFree

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

msvcp140

?id@?$collate@D@std@@2V0locale@2@A

shlwapi

StrStrW

rpcrt4

RpcStringFreeA

psapi

GetModuleInformation

urlmon

URLDownloadToFileA

iphlpapi

GetAdaptersInfo

wininet

InternetOpenUrlA

ntdll

NtSetInformationThread

version

GetFileVersionInfoA

mpr

WNetGetProviderNameA

wintrust

WinVerifyTrust

winhttp

WinHttpReadData

imm32

ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove

api-ms-win-crt-runtime-l1-1-0

_invoke_watson

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

fmodf

normaliz

IdnToUnicode

wldap32

ord45

Name

.text

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

23.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.J/<

Size

Virtual Size

16.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.(2!

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.,FT

Size

45.9MB

Virtual Size

45.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Redware.exe

d3d11

d3dcompiler_43

ws2_32

crypt32

setupapi

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

d3dx11_43

msvcp140

shlwapi

rpcrt4

psapi

urlmon

iphlpapi

wininet

ntdll

version

mpr

wintrust

winhttp

imm32

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

normaliz

wldap32

generic