Behavioral task
behavioral1
Sample
1324-56-0x0000000004260000-0x00000000042A0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1324-56-0x0000000004260000-0x00000000042A0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1324-56-0x0000000004260000-0x00000000042A0000-memory.dmp
-
Size
256KB
-
MD5
f11ac7e5c697aee2073362a24652a68e
-
SHA1
86a6b448d00a606dba89216ed827e13cf0a3b084
-
SHA256
54646a109d6431d0f4dfd65f7abb0a6e5169c8ea834d852321e24d56f7902f1f
-
SHA512
981af95c67914a6d3fa10099edced284d6c01cf60a326e6cb39ae00f7f351bdfd5e20e2fd9890b7c3242e53131a0c0431c8abfec7cda6a4995e0857acf8c8047
-
SSDEEP
3072:1IUcphQF470xNe0QA6AKlhD8e8hUovxOPxkav:RexvAKlhDyAPv
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1324-56-0x0000000004260000-0x00000000042A0000-memory.dmp
Files
-
1324-56-0x0000000004260000-0x00000000042A0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ