Behavioral task
behavioral1
Sample
1220-56-0x0000000004B30000-0x0000000004B70000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1220-56-0x0000000004B30000-0x0000000004B70000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1220-56-0x0000000004B30000-0x0000000004B70000-memory.dmp
-
Size
256KB
-
MD5
78e1d2a84ad7667fe4815a3234d9c68e
-
SHA1
ea179825de8e5e605957b611d705f82d2b2e1be3
-
SHA256
c30e5e794c1ade4c775d2a334e8ec3d5595499816ed3c75a41715aad28c1cf6e
-
SHA512
eec0f2c27c689ffc8d885161120d63c7a3685129a722e02b41920b5b58a96d1efd836ebb7d57239ab53c3e5f45c374a5390139d7744e6277686460e75c73e042
-
SSDEEP
3072:V8e8hCL8L1Uo+qVAw9v4IzKip8e8hC4Io28us8Wk2b:VZSOo+HdIzKipo28oa
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1220-56-0x0000000004B30000-0x0000000004B70000-memory.dmp
Files
-
1220-56-0x0000000004B30000-0x0000000004B70000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ