Behavioral task
behavioral1
Sample
05365699.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
05365699.exe
Resource
win10v2004-20230220-en
General
-
Target
05365699.dmp
-
Size
192KB
-
MD5
d8fd9610f8860a653ddfc4863f8e71cd
-
SHA1
15ccc5bf8e2174afdc329481c90ab9433dbfaa86
-
SHA256
8cc8f9bca177a46e6a4afa3c63cae92eb1f14f14c1daf3e0a2e3aed1a568887e
-
SHA512
ef7b471115dabeba088fd550021f4e6b442da76c479e9b1d2ec48b202e0d09668be65c589d0315edb2447413768d1e377d52c86b5dbc5ac5a97a93ccb30b8124
-
SSDEEP
1536:ogKedNi036sv0W7TWKygyvHWlLRsBChShr1xNQlYQ/nbux+vlYroYl0GkRJ8e8h4:oAIGPVd2CKr1xNHOVvWroYl+8e8h4
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05365699.dmp
Files
-
05365699.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ