Behavioral task
behavioral1
Sample
1532-114-0x00000000047F0000-0x0000000004830000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1532-114-0x00000000047F0000-0x0000000004830000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1532-114-0x00000000047F0000-0x0000000004830000-memory.dmp
-
Size
256KB
-
MD5
c0c275d016d2bd8359d3fe3cdf5234f2
-
SHA1
b2967e68bb66594ad48eaaf120ae90bc580c3697
-
SHA256
c388378504076c7d33d60212a79593bbf8ee0dd124fa3ed67ef68e4e0d58fbc7
-
SHA512
43fb980b2fa68d1c2b4fb54897b87b9495fa5d518554d1e68290dbc739d34d0bcbe21ead982134c7ce05f6151fca48ace36b4bbdb549ec75490e8a92a4d012c5
-
SSDEEP
3072:GZTK7A+LooqVIWLn4xkyj8e8h0St1aPkZTKt:Gxxxo+8xkyjCt48x4
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1532-114-0x00000000047F0000-0x0000000004830000-memory.dmp
Files
-
1532-114-0x00000000047F0000-0x0000000004830000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ