Behavioral task
behavioral1
Sample
1088-122-0x00000000048B0000-0x00000000048F0000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1088-122-0x00000000048B0000-0x00000000048F0000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1088-122-0x00000000048B0000-0x00000000048F0000-memory.dmp
-
Size
256KB
-
MD5
1855f174cb729e73ef15687a4ca6733a
-
SHA1
a6b0de8fbac99371ac75fa23a551ab75f2803fef
-
SHA256
0efbf0fd51228d0028f5e1d5f7a3c417b6054cc814120e5cde8c43cc64fa9fbb
-
SHA512
bc4433dde4369dd205bfae509a5361e4bd3ae98ee8707be6db7f3aaa13a104ae22f6de3c4067c9b0fe701e06c84ba280cec0e27a8ed27aa2476681543f25d3b0
-
SSDEEP
3072:2WtDiwyqSVghBjWtDiwyqSVghBBWtDiwyqSVghBGfAGtTjxNKifvWD:5ibuh6ibuhEibuhM5ZmnD
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1088-122-0x00000000048B0000-0x00000000048F0000-memory.dmp
Files
-
1088-122-0x00000000048B0000-0x00000000048F0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ