Behavioral task
behavioral1
Sample
0x0006000000014f02-1062.exe
Resource
win7-20230220-en
General
-
Target
0x0006000000014f02-1062.dat
-
Size
175KB
-
MD5
3cb5d75996ce446e06034137e8bc9d8f
-
SHA1
2b0c603ba10f1de9b165e10a3089cd6cce61e6fa
-
SHA256
531a51c109aeab809830593299294193f1cb48ece4c71d2494164b7bb01b0010
-
SHA512
fdc3eb1b6b84bc90c57ac82df8459691fe60981432baeff9dbcab1623c020d6ca7d302f393a523740d348ab8fba98a5f4d08b0ebee38e1cc6c1f363997cee0fd
-
SSDEEP
3072:6xqZWRZaPkOQ30dHClA+eyYF6hCjxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOh:oqZo0dH0A6h
Malware Config
Extracted
redline
legi
176.113.115.145:4125
-
auth_value
a8baa360c57439b7cfeb1dc01ff2a466
Signatures
-
Redline family
Files
-
0x0006000000014f02-1062.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ