Behavioral task
behavioral1
Sample
0x000600000001435e-115.exe
Resource
win7-20230220-en
General
-
Target
0x000600000001435e-115.dat
-
Size
145KB
-
MD5
9fcb62a13d2a94d228072ea5d032d7d2
-
SHA1
59ad78c2b5b8e00ecc6f3b3f329ec894c1f20f75
-
SHA256
31d32ef916cf4516ea3333070e1f2a438d2cf4c10348d84d2c29e4c245136fae
-
SHA512
79d4fc4b9c35926dc4fcf959c3586185bd5c5a39e96f0903887e0593739154bbb6cbace30e5c47851a9acc200b0e4eaf9d6a4351a9724bc2b890816e372dd84a
-
SSDEEP
3072:pV+m5cVQmRSxRGAFiXAgmpajhhuZO8e8hWGn:pj4giNXjhhuE
Malware Config
Extracted
redline
daza
77.91.124.251:19065
-
auth_value
0bd5963efefdd6409185423d5ca3439c
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x000600000001435e-115.dat
Files
-
0x000600000001435e-115.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ