Behavioral task
behavioral1
Sample
1052-56-0x00000000011D0000-0x0000000001210000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1052-56-0x00000000011D0000-0x0000000001210000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1052-56-0x00000000011D0000-0x0000000001210000-memory.dmp
-
Size
256KB
-
MD5
04ae3c7bb747d32f2d746d2d35490d2a
-
SHA1
5ab63ed128dc7fc341f2c583831f3130d46b3744
-
SHA256
e0d35f0ca6880b57c97da3554e39878883834cad8ca642aa6f586b8e3feb8853
-
SHA512
eb93ca4dcb537695d402d3e13bc250e1b7db1187f8f223057f9f3d8335d0224b741a11ffe72cec0bf0f479f2947cd6e4b5e448880af287b9d068a21e5c1838ed
-
SSDEEP
3072:f8e8hURByZ/DTxN7SsXLJVVEx8KW8e8hUjMyTqi:fR0DXRFVVEx8KWjMM
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1052-56-0x00000000011D0000-0x0000000001210000-memory.dmp
Files
-
1052-56-0x00000000011D0000-0x0000000001210000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ