redline | 2476-54-0x0000000000B80000-0x0000000000C4F000-memory[.]dmp | Triage

Sharing

General

Target

2476-54-0x0000000000B80000-0x0000000000C4F000-memory.dmp
Size

828KB
MD5

5e6d0ad560bae72a82dd4f5fc9caa7e0
SHA1

d851248d1bac14f97cf515e9956f6dbcdbd0b60c
SHA256

fa929b957bc2e40b9a848263d887a8667016cd959300d84ad5b378e97b88f953
SHA512

780cf5d1a3342533a91111f60f2b1dcabbde92d001af6c0820d92250b20c2e5cd3f085e77a894e8387c1c899b3666a5f6acb5375079f968a4f65677cc41f2bae
SSDEEP

24576:e7sSRcYlWFhmTdrVmUo476lZsap37NI0fqSRF:e71lWFhmTxVmVZ1pqSv

Score

10^/10

redline

Malware Config

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2476-54-0x0000000000B80000-0x0000000000C4F000-memory.dmp

Files

2476-54-0x0000000000B80000-0x0000000000C4F000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 522KB - Virtual size: 522KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.LLK
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ