Behavioral task
behavioral1
Sample
3f6bc8ef3023fe1aa3956e6134af78b0.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3f6bc8ef3023fe1aa3956e6134af78b0.exe
Resource
win10v2004-20230824-en
General
-
Target
3f6bc8ef3023fe1aa3956e6134af78b0.exe
-
Size
25.3MB
-
MD5
3f6bc8ef3023fe1aa3956e6134af78b0
-
SHA1
b68650330210096ce8f94586dd4741babae0819a
-
SHA256
fc6f534c0c0bd66d8973712b52ae241b3503a942645e18ee72e551b977eaabca
-
SHA512
3ba9c96d87e2b4e69aa575f6b276994cb1f1ee3caaafcfb942be4f46f23cd5042fed9bf24d59733513f9c259aa045a134a4e8b257ece4e1acd994150b24dd2bd
-
SSDEEP
393216:MdXQyvh0Xtz9jakSW0bbVCX9rmOE1cnHD:UXPh0tzHSAX9rTEan
Malware Config
Extracted
redline
1
135.181.226.131:13769
-
auth_value
b7f3e468519a96db8237957d5c343c66
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f6bc8ef3023fe1aa3956e6134af78b0.exe
Files
-
3f6bc8ef3023fe1aa3956e6134af78b0.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 20.0MB - Virtual size: 20.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ