Behavioral task
behavioral1
Sample
1432-56-0x0000000004AF0000-0x0000000004B30000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1432-56-0x0000000004AF0000-0x0000000004B30000-memory.dll
Resource
win10v2004-20230221-en
General
-
Target
1432-56-0x0000000004AF0000-0x0000000004B30000-memory.dmp
-
Size
256KB
-
MD5
c855eff2af7ffa808ea8b565a7f53a67
-
SHA1
fda841b839e370a4758b689e80c9f475dbfeec6c
-
SHA256
c0cb80413bd0ef7ff214dc3d788b0b61976a5feb03850bdf211af18125df2c7d
-
SHA512
eb1b82643b1ee802ead7bce6e47dd7e69f7f30c8c94939d0a7a0a60b8276486d9141194c335867fbeb7025586882584970dca0b328c9e66d27446dcc34bcf2a7
-
SSDEEP
3072:n8e8hLTs4kXYz3slZvt1xNZOqG0oQoB8e8hL:nmNt2vtLZoQoB
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1432-56-0x0000000004AF0000-0x0000000004B30000-memory.dmp
Files
-
1432-56-0x0000000004AF0000-0x0000000004B30000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ