Behavioral task
behavioral1
Sample
760-112-0x0000000000340000-0x0000000000370000-memory.exe
Resource
win7-20230703-en
General
-
Target
760-112-0x0000000000340000-0x0000000000370000-memory.dmp
-
Size
192KB
-
MD5
6c8d4f3530279aa2817690364219ee76
-
SHA1
a7e57b7df560470bea3790db3675580dab8f3398
-
SHA256
edbd1ed664ded97999188f4a4f79628e3e88c7b085e2ab7f66544423ac068b18
-
SHA512
9b6f1ef416467232e4cd325211cd211317e26fc7416c55478468e8f0549cc2e0b43b6e0c2ae60f33a25b304469515be64ff4949b1b50915b3da2cdaa53cf75b4
-
SSDEEP
3072:YO64zyFlJDGx0HqSYxNXUfMim4G3z8e8hE:sf1s0HZ8em4G3z
Malware Config
Extracted
redline
norm
77.91.68.70:19073
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 760-112-0x0000000000340000-0x0000000000370000-memory.dmp
Files
-
760-112-0x0000000000340000-0x0000000000370000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ