Behavioral task
behavioral1
Sample
1496-56-0x0000000004A80000-0x0000000004AC0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1496-56-0x0000000004A80000-0x0000000004AC0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1496-56-0x0000000004A80000-0x0000000004AC0000-memory.dmp
-
Size
256KB
-
MD5
37e918a2cb1dd128a74f64ea4c16f75e
-
SHA1
82b25f1d2e99db612833aa9446ac217fa570a0db
-
SHA256
5380c4efcc4d7bc19ca1f46ad93f129e229b9005a2a97f2b2c647c530b0c9b4f
-
SHA512
484443559685289e9b034e8b98febcdaa7296a5632dd789b50f69b0e325593a5f969bea92f90885499d88debd7d9c75fa8b4c62b45614100c47876fc9d9346ba
-
SSDEEP
3072:A8e8hhNzArbYm66HKzLSFYuxN4eCeWC/qUU8e8hh:A6+bYn/SelW/qUU
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1496-56-0x0000000004A80000-0x0000000004AC0000-memory.dmp
Files
-
1496-56-0x0000000004A80000-0x0000000004AC0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ