Behavioral task
behavioral1
Sample
19921220x0000000000450000.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
19921220x0000000000450000.exe
Resource
win10v2004-20230703-en
General
-
Target
19921220x0000000000450000.dmp
-
Size
192KB
-
MD5
cb1b910a292e3ec9a31a3d0d3c8f936f
-
SHA1
371310c90099414360fee2da02d3ed27ce9d6c35
-
SHA256
9fd756efc0e1071dc9508c79b0ec705c5a5c61ccef495e5330478434b0dbec10
-
SHA512
62e4aa9d31c98497d0aab33800177a6b36eedbf0ad7bc1200e30d2ef5f33b2d3fd81b157025decf47c50612c4431ff0ac743364145e9b1def560f9bc778d2515
-
SSDEEP
3072:6EV5bSQxA6IldyYxN3KVaxLzzUY472U8e8h9:6EFAlW8TLzzUY472U
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19921220x0000000000450000.dmp
Files
-
19921220x0000000000450000.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ