redline | 1632-54-0x0000000001300000-0x00000000014A4000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1632-54-0x0000000001300000-0x00000000014A4000-memory.dmp
Size

1.6MB
MD5

a2bb86fc8b201d44f4bcb29912090b8c
SHA1

bbe2cccaca8afd37bcd877e92b693548ee6b716a
SHA256

86a5a48334bc7c4e1a79a4aad5ab369c4415090c5835f73148bb58e7146e5554
SHA512

34e0f975593f043bfb24f510a3aff34834a3ef4355a33ef1e0ae81a8f4226b213ba48a94c5e6efe4de72b7f8662dc0378e9a093a46140dc3854bc9f403751876
SSDEEP

12288:ahBoNSkrAfCIcvyY4Vea9zhF3+GIlwNcWCDiEQG9uzdfqeZuVoK/tWT8F5Fbn:WoNS4AfCIcS0wNcWGQGC8l15Fb

Score

10^/10

redline

Malware Config

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1632-54-0x0000000001300000-0x00000000014A4000-memory.dmp

Files

1632-54-0x0000000001300000-0x00000000014A4000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 626KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Sa2day
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.Scorpy
Size: 685KB - Virtual size: 684KB

IMAGE_SCN_MEM_READ