Behavioral task
behavioral1
Sample
872-102-0x0000000004D00000-0x0000000004D40000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
872-102-0x0000000004D00000-0x0000000004D40000-memory.dll
Resource
win10v2004-20230221-en
General
-
Target
872-102-0x0000000004D00000-0x0000000004D40000-memory.dmp
-
Size
256KB
-
MD5
6f13bc95938714f1420e75c60cdaa459
-
SHA1
627a086e0b08971e9de1527086f40f8492a91579
-
SHA256
a486f6f871a60a323640ad2ebad85df1cd4cb6747f6e724c07f492591da8edff
-
SHA512
30a7853ba879762160ec23765f277b7f656398f54c613c0f4e3137cd7d92b70eff03996ab7940529c6a630dee3f4a981e10792ab6cf0bcc9f6054c90d0f3d9c4
-
SSDEEP
3072:T/4O1/jHX8WNS1DSE6RZHSSSSSSS8SSSSSSSSSSSSSySSSSqSSSSSSSSSSSSSSSJ:T/9j/SuHbp9PJx
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 872-102-0x0000000004D00000-0x0000000004D40000-memory.dmp
Files
-
872-102-0x0000000004D00000-0x0000000004D40000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ