Behavioral task
behavioral1
Sample
0x0008000000012313-116.exe
Resource
win7-20230220-en
General
-
Target
0x0008000000012313-116.dat
-
Size
168KB
-
MD5
a2fbd81e2f3b948d4d272a676ed66ada
-
SHA1
89a5be92d4e287814463b081c5a7ab743c6992c7
-
SHA256
0b42dae0adc00aaac3418ac248c3b0648f0d598ed46e450ecf1119359525ecd3
-
SHA512
534470f574692e9411806f4c1736bc59fd29b28ad5804bf184798d1f4fd1b755cad968b0229b8bc4feeb9210bbcf58a95068367aa963352a3852974b4b85d6da
-
SSDEEP
3072:o2D58WWcgrLcLzCbqVG49IPvFXQ8e8hW:o2ecgPbN+sFXQ
Malware Config
Extracted
redline
lessa
185.161.248.75:4132
-
auth_value
29d77029685f0783eb0ec17c1b173cb2
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0008000000012313-116.dat
Files
-
0x0008000000012313-116.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ