Behavioral task
behavioral1
Sample
1648-124-0x0000000004CF0000-0x0000000004D30000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1648-124-0x0000000004CF0000-0x0000000004D30000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1648-124-0x0000000004CF0000-0x0000000004D30000-memory.dmp
-
Size
256KB
-
MD5
ddec2874ce19ed8f3bddd73bb612e09c
-
SHA1
dbb562d24c862b3eec34302a74f14451468dcaaf
-
SHA256
0ae6a72138cc208c9c5294401b4fc2a62616343558c22ac7a1ff449b66b151ee
-
SHA512
469d0a272dd2678ea3afa066a9beade50aade4d23654b885c0450252083fe60e967b38a87cae34d0f3b59b59f2c6a34094143f82652a1f808fd8968810882622
-
SSDEEP
3072:o8e8h3Ad3+v8T3Ei8Wej9gWqVSYQRqHd3n8e8h3nY:oDd3kS32rpwHd3nH
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1648-124-0x0000000004CF0000-0x0000000004D30000-memory.dmp
Files
-
1648-124-0x0000000004CF0000-0x0000000004D30000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ