Behavioral task
behavioral1
Sample
1128-55-0x0000000000400000-0x000000000042A000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1128-55-0x0000000000400000-0x000000000042A000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1128-55-0x0000000000400000-0x000000000042A000-memory.dmp
-
Size
168KB
-
MD5
07e2fe00e4652f4e42c1679bbbc3b2c5
-
SHA1
12b675b6ae027945f042c803016ab789a543b4c5
-
SHA256
7c7f69dccdc6130fbb38d8aec39ea49d9e830f608585856bff0d791c436b9765
-
SHA512
9dcb7ff631082ac339d778a069d4e4d8e59a0bcba148068819417cc87b05a5210e89c0b980aa5cb58c9bb2bed3b626b3da5f06958410117bb110144a70c095fd
-
SSDEEP
3072:4V+m5cnQmRSdMoaEChJpxAx++6hiZ98e8hC:4jenoa9b06hin
Malware Config
Extracted
redline
5.42.65.101:40676
-
auth_value
88cc781de5becc28ea3e77ea162a422a
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1128-55-0x0000000000400000-0x000000000042A000-memory.dmp
Files
-
1128-55-0x0000000000400000-0x000000000042A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ