Behavioral task
behavioral1
Sample
0x000700000001314e-106.exe
Resource
win7-20230220-en
General
-
Target
0x000700000001314e-106.dat
-
Size
168KB
-
MD5
f4b4fac51180a4cf6ba1d38ad720a471
-
SHA1
adae2342a7eb98e56a1ed6062e63256895f72349
-
SHA256
f50f42fd4c074f202c1692d93c28b2c8319c357a60fea7fe57c65b318072477f
-
SHA512
bb8716cb75be89a02da17c0e6131a2282126cb1008cd9b8ed2d7aa73abbf0f7e28493e4df4fc3c0d8f9fe31960e50b1140af69e42ec7530eba7ae6cfe3bfe378
-
SSDEEP
1536:NzCgbrKbDkrqlVZRGWEzVrt+RXrAyB1LcPcaTGqVYbujlL8+4xky83wYkc8e8h0:N1aPkZTK7A+LooqVIWLn4xkyq8e8h0
Malware Config
Extracted
redline
morty
217.196.96.101:4132
-
auth_value
fe1a24c211cc8e5bf9ff11c737ce0e97
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x000700000001314e-106.dat
Files
-
0x000700000001314e-106.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ