Behavioral task
behavioral1
Sample
1204-56-0x0000000000DF0000-0x0000000000E30000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1204-56-0x0000000000DF0000-0x0000000000E30000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1204-56-0x0000000000DF0000-0x0000000000E30000-memory.dmp
-
Size
256KB
-
MD5
8ec95822bc55a098d8b20195484dc0bb
-
SHA1
71a68388ed188c380f4a24c690f2d76367ecc107
-
SHA256
ab57c4412d5c3594c69980c6a027d1686a26a0dd06efe06dfac2064485b6e64d
-
SHA512
9c21ff96ca9be541a97e48346b6c4154f7e1cfa9c7e3fc4fd47b576b797c0fc1ff74dd6e925f5013c16d143397cc93ee1fa544004e4c2e0bbfa11cc41f1f985b
-
SSDEEP
3072:f8e8hURByZ/DTxN7SsXLJVVEx8KD8e8hUjEyTqi:fR0DXRFVVEx8KDjEM
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1204-56-0x0000000000DF0000-0x0000000000E30000-memory.dmp
Files
-
1204-56-0x0000000000DF0000-0x0000000000E30000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ