RedApp-Setup-windows-x64.zip
- SHA256 ba99acf5defe3c23fd469f7b2d5091e6217a81f6ffe4d40ede4d603a3547d0d1
Behavioral task
behavioral1
Sample
RedApp-Setup-windows-x64.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
RedApp-Setup-windows-x64.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
RedApp Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
RedApp Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
launcher.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
launcher.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target RedApp-Setup-windows-x64.zip
- Size 23.3MB
- Sample260820-aak2saad29
- SHA256 ba99acf5defe3c23fd469f7b2d5091e6217a81f6ffe4d40ede4d603a3547d0d1
- MD5 9ad7473b2c0063f42a010fae455558ef
- SHA1 42edc5441df5c32edfcc5d244bb967846e3a7b71
- SHA512 cd43d25ea3537e0f619d3d5ad5b6a648a64052eeff62eee45b8c479e43832d6b5107e9f8cd6327da57f316dba06cfeb95b16e44118153ed448bb92637a75cad2
- SSDEEP 393216:hyQ+LLSPqOUKZGbk5CXb7zsjhOrkKIKSQ1aSFYyBax0Vpk5jLF8eAwxsPGCi:hyXL6qAZzcPsYUKn6yBaxDL6EsM
- TLSH T1493733B6958FADE8B62E251615282530099CE94C23F7EF050D9D0FE2F86113537B3AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/RedApp Setup.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RedApp Setup.exe
File Explorer
-
RedApp-Setup-windows-x64.zip.zip 23.3MB
-
RedApp Setup.exe.exe 23.6MB
-
launcher.pyc801B
RedApp Setup.exe
- IMPHASH 8f27129f70815ed9882a468f0cdfef13
- SHA256 9442037178a9af3ac0177ad12bb21c115e3233520b312d3536b637ec5cf85351
- MD5 4d7178f83482f9a8fc0dd365f139f677
- SHA1 6927ecd6e48fa33603c547c18a3c49595d3e4c17
- SHA512 96aa04f90cf8ae59f06e606712d0f247c2e6dc168fce8f926060602b75984dacae3dbf4381ed33d41e98635471e320549d0896f7edb2769dba526d5f52e281e5
- SSDEEP 393216:uoLIIhR+mIHjnO581HuCKMM2tKhHTodRGkXhSaxIqOlI52Pduc8DKdM8:VHhRZIHLOSECW2tc0LhXsaxbQbCK
- TLSH T1694733AB92D958E5F9AB523909A5943467B2784013A2E78F0AFC0F937D131703D31BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
55840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CloseHandle
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapSize
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleW
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
launcher.pyc
- SHA256 ccb8fcd36b22f5d6fc7a268a38ac23c66a8ba172d6f5005670b3c7094f2d974e
- MD5 0d1faef8305e066b16a3c75cbf3a1e73
- SHA1 2294700d3b9afe2819cbf0cec90d744355a34216
- SHA512 24a2a1d56cc80c26750ab31db76df177e82fb5039312d5d4c9c40bc556ffa365cec21e43d27d3bb3aa0f9eaf99d240c8340459b0c51e482261b9ef334de5e588
- TLSH T1FD014E527E5233F3D0D84FFDA4FAC7AE2A25E0AEB2675397E02855227C062640D902CD
- MD5 SHA1 SHA512 TLSH