Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
General
-
Target
file.exe
-
Size
174KB
-
MD5
0300c281ffed79e0a52c094b659b4646
-
SHA1
8760546538e1df82f75da97d0e9af80784b268de
-
SHA256
1f8cbca09ab28bf32ee53b0674064aa827ad246aa655a12a7a0da08e1e8dbeab
-
SHA512
e583d6113d25d34922b1195b4a1710b6c378c26e599fd2ab08e7b2c52c8716049bd428c19baaf7c2383f705f3bd698dee4e90be763bd9ce58e2d30e349b30469
-
SSDEEP
3072:MFFniSjyI0is+mFOvGsbIU1PM8/E0kBPUJZ8e8hf:6F5yI0is+mBC/E0x/
Malware Config
Extracted
redline
sq1
185.225.74.51:44767
-
auth_value
698af4e4684b19e1acea9a7ebb86fc9b
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ