Behavioral task
behavioral1
Sample
f1b2907961bb791a8488e3fb5b3d6478.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
f1b2907961bb791a8488e3fb5b3d6478.exe
Resource
win10v2004-20231023-en
General
-
Target
f1b2907961bb791a8488e3fb5b3d6478.bin
-
Size
248KB
-
MD5
f1b2907961bb791a8488e3fb5b3d6478
-
SHA1
0e3951236c03830ae186a456fab76fa6e7cafa41
-
SHA256
6ddd42ea0794c33301c2ffa05fce11523a88b1b85b951aa70568eb949de0f0d9
-
SHA512
1d06687bfac027d41c2fd400bd9ed3a022c5eb7ac92848510a639d2ee4021f87908866e2dc333a202d85237f7e43c7a8a432734899753b2aee6ea0c01ba06e4f
-
SSDEEP
3072:6yng4InXNgcy9Wy3aPGcntCTt/qhGFlvDYLXZiTtze:7g/XNgcWr3aPu/5FlvDYLpqt
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1b2907961bb791a8488e3fb5b3d6478.bin
Files
-
f1b2907961bb791a8488e3fb5b3d6478.bin.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ