Behavioral task
behavioral1
Sample
1932-56-0x00000000042B0000-0x00000000042F0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1932-56-0x00000000042B0000-0x00000000042F0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1932-56-0x00000000042B0000-0x00000000042F0000-memory.dmp
-
Size
256KB
-
MD5
0af71f31588e785758096d9945ce7ed2
-
SHA1
5b46ced1cf1eeba4ce31b5a22af98513de65f0da
-
SHA256
c77668f47571628e1b1d2434e14576b53869065ab66ea41f0192034d08749c7f
-
SHA512
4f6308051bfcb9700314b109b65266efffae6be02b18acd5063508c4765ce627075b259f56670821cf3237642a4dd4403e93b908e938478ed904d9b896e3818b
-
SSDEEP
3072:Z8e8hFKiINo/i6qVOg+uA+EiA8e8hF9rGkzIa8WuPMx0:Z7idPtb+EiAQikzZO
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1932-56-0x00000000042B0000-0x00000000042F0000-memory.dmp
Files
-
1932-56-0x00000000042B0000-0x00000000042F0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ