Behavioral task
behavioral1
Sample
0x00090000000122f2-78.exe
Resource
win7-20230220-en
General
-
Target
0x00090000000122f2-78.dat
-
Size
145KB
-
MD5
b0be3104376460f17843e692b5f9ae31
-
SHA1
765bf6850b10ad692087205d55aeee597da17043
-
SHA256
245d7dd9e72157b2e186d4574f39c05b678b31e7c10165115ac322e62a03a45b
-
SHA512
242d42101074331364e7047be00937cc45c3fe8599452cbfe922bd00504c89f9b527b04af2bcfa83b029763494fb607944b0111765c2b519a5a6a59714c96ecc
-
SSDEEP
3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z
Malware Config
Extracted
redline
duper
77.91.68.253:19065
-
auth_value
57e17ebbdb18f4882b95fe05402ef1c8
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x00090000000122f2-78.dat
Files
-
0x00090000000122f2-78.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ