Behavioral task
behavioral1
Sample
prives.exe
Resource
win7-20231020-en
General
-
Target
prives.exe
-
Size
1.9MB
-
MD5
c9c252cf6429b1ce52046120a950a040
-
SHA1
da4fbd880c2f803e4daab2935e32eac2673069c6
-
SHA256
db490d3625b1c130d0d0eedd5c2042ec991537970482ee3b5bd6cfd4836efc73
-
SHA512
cb0f8d83ab131e64ab387ea9204ab3de873d8ac7cded915424aee521942b79067cf4e75ab0726cb975c2a62cd098404fa35ab3c741dd87650c8921f71b8c8ebd
-
SSDEEP
24576:o92zl8H/GFuw+deakO+C9xFHhAzLWBP68biBftts9gvKe3:o9tdea1HhA3SbuPts9g
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource prives.exe
Files
-
prives.exe.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ