Behavioral task
behavioral1
Sample
3352-193-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3352-193-0x0000000000400000-0x000000000043A000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
3352-193-0x0000000000400000-0x000000000043A000-memory.dmp
-
Size
232KB
-
MD5
c520366094f723099e45c454412f1cb9
-
SHA1
d300e3474cfd22aca03522694679fd7883aa4f7f
-
SHA256
e065d0381abe393c95ad76c5e34163ac1d009fd3b68272e01ca92ea47b3133c3
-
SHA512
5108e4784d48c5715c886527274afbe6b25867d4c53044940f633f1677c07a8be0f698efb8c33bc949749368ce0bc7221507cd7a48d5ca69a14549bca065dfce
-
SSDEEP
3072:ttiyRrqCnNsZWSZ5GxN8yi8yIHVF+q8e8hOJo:Zdti5ZkvVF+qM
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3352-193-0x0000000000400000-0x000000000043A000-memory.dmp
Files
-
3352-193-0x0000000000400000-0x000000000043A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 176KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CvAr4y Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ