Behavioral task
behavioral1
Sample
2572-1-0x0000000000400000-0x000000000042C000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2572-1-0x0000000000400000-0x000000000042C000-memory.exe
Resource
win10v2004-20231020-en
General
-
Target
2572-1-0x0000000000400000-0x000000000042C000-memory.dmp
-
Size
176KB
-
MD5
07f5cd6d7f141ca43b6629ccfac7013b
-
SHA1
eeb1f043f951552365c7012c9f6ddeaf690e402d
-
SHA256
9d8a172f1a8d2eed3813173ca51bbdddc469974cde31ae19778b34d1c762bc8a
-
SHA512
838091ab8bf39a101b0e549320cec038b2ed88207fa5984dbc2412c57c545d38034a6b6fae21c3c5fcedc40bc0acacb2a5554ef4d4f53b70f56cc9e29eace470
-
SSDEEP
3072:5G7I6lfIRxRKyPvAEjhPm4tmrEDUdzFkDSuOkZDcXiqEqVy0F54:5cI6lmpWnKDRAXm
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2572-1-0x0000000000400000-0x000000000042C000-memory.dmp
Files
-
2572-1-0x0000000000400000-0x000000000042C000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 99KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nuryv Size: 2KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qbwrxz Size: 572B - Virtual size: 1024B
IMAGE_SCN_MEM_READ