Behavioral task
behavioral1
Sample
b8f4d37298efbff82ec07aa49.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
b8f4d37298efbff82ec07aa49.exe
Resource
win10v2004-20230621-en
General
-
Target
b8f4d37298efbff82ec07aa49.exe
-
Size
173KB
-
MD5
b8f4d37298efbff82ec07aa49ee502a4
-
SHA1
cbf9a545ce74d9cb72404fb77a3e4d9bcfcd2e6a
-
SHA256
c2135daa85b4be7b7e17624ebf3919789052a29d9aef41c86dabed291a283b3b
-
SHA512
2380765c245dcd205bc1b2c55a268bca473aea9460970132f11410d66ef0123b8087dd331353a3780b1b2d60e137299b09fc0046eeb2708b64c65298f01926c0
-
SSDEEP
3072:JJKwy7lNGoll6ixNM+NT673qGTZ8e8h0:JQjGolAhB3qGTZ
Malware Config
Extracted
redline
95.217.14.200:16615
-
auth_value
1bfac947c350008abe813772b735f0fc
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8f4d37298efbff82ec07aa49.exe
Files
-
b8f4d37298efbff82ec07aa49.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ