Behavioral task
behavioral1
Sample
1236-56-0x00000000048E0000-0x0000000004920000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1236-56-0x00000000048E0000-0x0000000004920000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1236-56-0x00000000048E0000-0x0000000004920000-memory.dmp
-
Size
256KB
-
MD5
acf9dd9f145518e6e8a3d968bc373396
-
SHA1
0d0ee732af85bdcad76d2238bcd1fc8483ee1688
-
SHA256
dec036a84d77707e12dd4bca24e65e111b80bfabaa5edc321d19ca17bb8fc490
-
SHA512
949259c04c050be6fd708142ace8c01ddc03d31feec161ce0b5a77a408578e35a361b611b32016a7d0bfa1948a70fbf43b256dba1135770577e8627ec3c23e37
-
SSDEEP
3072:88e8hEl8nVYFlqVsg4/ywuHx8nj8e8hETPAVVKve8WCXYR:8V8nV0DZFuHx8njLAVV+rX8
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1236-56-0x00000000048E0000-0x0000000004920000-memory.dmp
Files
-
1236-56-0x00000000048E0000-0x0000000004920000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ