Behavioral task
behavioral1
Sample
2156970x00000000003000000.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
2156970x00000000003000000.exe
Resource
win10v2004-20230703-en
General
-
Target
2156970x00000000003000000.dmp
-
Size
192KB
-
MD5
e8c08f5dd72be56c2b1d09dd22099486
-
SHA1
4ed25f79798a85c5ff535dcdfd1e59862e2ebedf
-
SHA256
e93151f2c85dcb531268b1e064433ffe8ca5167f656eceeb66c5ec6f2c1aba6b
-
SHA512
dcd440697cbac47af6c904e35fe74e02fae445cec3e6d61fe8049315a235b9cc116c6f6480aadb4bc3463270f182d729313dc6f75123fe830f66f347c3666f6c
-
SSDEEP
3072:yN9zgaHeuGhriktrBxN3kuZ+zdzl8e8hj:I9Ie4rhTodzl
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2156970x00000000003000000.dmp
Files
-
2156970x00000000003000000.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ