Behavioral task
behavioral1
Sample
396-114-0x0000000004CD0000-0x0000000004D10000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
396-114-0x0000000004CD0000-0x0000000004D10000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
396-114-0x0000000004CD0000-0x0000000004D10000-memory.dmp
-
Size
256KB
-
MD5
fd215e18fc433d5d05f1cc13dfa6c1b1
-
SHA1
3accb5867697d2d7bbc1e6c4ba1f8fd1c818e2f7
-
SHA256
41f7c6763fe3fde95692b8c2dbf58fe5bb7ce54c77eb935529a53bb6a1b51fa2
-
SHA512
aedfc29c85d0c0bbc206ff14109248928c9aa0a9084dc43d86d66d2e9937769aeaf8a9acd3d46d7bd6d1128034a05331710fcedb9b3ed2d37a25cd0582da317a
-
SSDEEP
3072:uFk8WTVpdQPqVYI5vDnRYKlQ8e8hRFoiqFk8WTV3:uUYHGnRYKlQpiqU3
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 396-114-0x0000000004CD0000-0x0000000004D10000-memory.dmp
Files
-
396-114-0x0000000004CD0000-0x0000000004D10000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ