Behavioral task
behavioral1
Sample
396-120-0x0000000000550000-0x0000000000590000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
396-120-0x0000000000550000-0x0000000000590000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
396-120-0x0000000000550000-0x0000000000590000-memory.dmp
-
Size
256KB
-
MD5
662030db98fd2332526a95e5026b3621
-
SHA1
04f6fa2a263c840c5400b0ede0995313622f7619
-
SHA256
987837d09c89be8658b9a1746a07b2406a6fc7b584e6ee29dfbb4cde3d468a8b
-
SHA512
e5986b4e3e822928587ffb3364c0c570ebd7a65587e6d30a94211131daa006b36933e5c1eb53afa62db9cf440d8f9baa3a62c6f04972333feb506f4211d9a9e3
-
SSDEEP
3072:h8e8hbQyNgq8oMGl9ixNcO3qdLbkSj8e8hbRUYvpRl:hRoVrLbkSjYN
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 396-120-0x0000000000550000-0x0000000000590000-memory.dmp
Files
-
396-120-0x0000000000550000-0x0000000000590000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ