Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file
-
Size
172KB
-
MD5
bb27d2d5c26f5bc2c45b600050d2d427
-
SHA1
f3c91ad27b6118e1a0a0a39f582261ce382dd6ce
-
SHA256
6a6dd0a26989161e2d1092fd369a5581efbaa469b9cc7f9fc4b9f89ca5dbb08a
-
SHA512
5de7b62a32678b0d21f24c54857a50059562e5277ef5bdeb4a165ddb2c839d25b4d05f698ea200969149bfe06b5b27fdd820b4ea16dec832cb8fb109b53f7e64
-
SSDEEP
3072:s8YZaE3bscxNeSnWkX7fJ1CeSILr8e8hw:sFwxAX7fJ1CeSILr
Malware Config
Extracted
redline
rt2
185.225.74.51:44767
-
auth_value
dc7db5b7b2a3c650d2442bad9e77751a
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file
Files
-
file.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ