Behavioral task
behavioral1
Sample
2016-56-0x00000000005C0000-0x0000000000600000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2016-56-0x00000000005C0000-0x0000000000600000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
2016-56-0x00000000005C0000-0x0000000000600000-memory.dmp
-
Size
256KB
-
MD5
db1f90ac9c7e18fa6d0e819d08735391
-
SHA1
6608247dc496c0d281463eb1359e2ad200ea8272
-
SHA256
553b523dd6b7b6b455e8cb98fcd0d921ba1992dd709857296a774f431516d5d7
-
SHA512
149a3c57f01d4653ed1ea8331ba765cddd4466c86e278b050bc6fd40b6f90ecbdf5b1fdc66c89f91bcdb1a9b0298c5e7c32399e8301d7c47f41c9b44a2bc7ce6
-
SSDEEP
3072:r8e8huUA9DjsNkbqViT141N1V41M8e8hu:rt9Xlb8N1V41M
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2016-56-0x00000000005C0000-0x0000000000600000-memory.dmp
Files
-
2016-56-0x00000000005C0000-0x0000000000600000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ