Behavioral task
behavioral1
Sample
1536-114-0x0000000004AB0000-0x0000000004AF0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1536-114-0x0000000004AB0000-0x0000000004AF0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1536-114-0x0000000004AB0000-0x0000000004AF0000-memory.dmp
-
Size
256KB
-
MD5
f8f8e20151e8d5b8b6fd481df9229795
-
SHA1
8a9cf15955a759e283d43d9682819c89e46587c5
-
SHA256
9da95d0c07d072585f3e5bf5c25c886f0b2046f24bac795665361a76d08d7303
-
SHA512
28edba33b4640b276d9371e73fd7a0e410a606a596f51a5443a9b41fd7443a8ed0c0cf8e88459ae8f994da3a6353339ca7aec64a1995857cec567e6ca4cb6def
-
SSDEEP
3072:a8e8hlCBGN+pT99xRUxFqVSTYkNpR8e8hlPr:aRgNoTLc5NpRe
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1536-114-0x0000000004AB0000-0x0000000004AF0000-memory.dmp
Files
-
1536-114-0x0000000004AB0000-0x0000000004AF0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ