Behavioral task
behavioral1
Sample
14bad67ec2245532fb26c134659092a5e7adf11ee36b7db070b5540d74ecf619_JC.exe
Resource
win7-20230831-en
General
-
Target
14bad67ec2245532fb26c134659092a5e7adf11ee36b7db070b5540d74ecf619_JC.exe
-
Size
174KB
-
MD5
0c454fe19ab58bcbe05e0eaf0f9e5fbf
-
SHA1
803982af280ca1691caaeaf85f67f1855fe44561
-
SHA256
14bad67ec2245532fb26c134659092a5e7adf11ee36b7db070b5540d74ecf619
-
SHA512
b29a3e22bfe4762ca231e9d5089c200e6561ead2e12758c5a5985e3f026d809b04c40233822411103bef5ce63ec6a28c586e84c87a7ce05d50b7827240a9a8c2
-
SSDEEP
3072:OHIoRDFDI0V7bCnOW0Sa01yTzEPN2wCDEE0aWcjqRLF0lJZ8e8hk:IIsDI0V7bCbsEE0LdRLF0lv
Malware Config
Extracted
redline
DZ18001
149.248.44.40:26069
-
auth_value
28b749e7d03a441396e78bc1d2a217f8
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14bad67ec2245532fb26c134659092a5e7adf11ee36b7db070b5540d74ecf619_JC.exe
Files
-
14bad67ec2245532fb26c134659092a5e7adf11ee36b7db070b5540d74ecf619_JC.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ