Behavioral task
behavioral1
Sample
920-56-0x0000000004A00000-0x0000000004A40000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
920-56-0x0000000004A00000-0x0000000004A40000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
920-56-0x0000000004A00000-0x0000000004A40000-memory.dmp
-
Size
256KB
-
MD5
a1fa5961b48cbb69ac6b498e69f77bfb
-
SHA1
d33b18b3db4eb18d61f2f8f74e91647fec96fa47
-
SHA256
7572719f55ea89485afb0359b59ddf725526e346a13f5d316947724bf59973bb
-
SHA512
cf7ac2101a7874f9194b613ec9f81394d3edca1e5e1ad69e4923b585a6bef03122890a5c04c9f8255f07dd7c70e86108254ad684ad3819dec227b8dfda557465
-
SSDEEP
3072:x8e8hRRfSikw038WSHI6BFRqVIgE3jU5i8e8hRDf:xufS5w9Hx/ZU5iKf
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 920-56-0x0000000004A00000-0x0000000004A40000-memory.dmp
Files
-
920-56-0x0000000004A00000-0x0000000004A40000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ