Behavioral task
behavioral1
Sample
99ef8c69ab389d2fa3a6491704fcd0d5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
99ef8c69ab389d2fa3a6491704fcd0d5.exe
Resource
win10v2004-20231215-en
General
-
Target
99ef8c69ab389d2fa3a6491704fcd0d5.bin
-
Size
4.4MB
-
MD5
99ef8c69ab389d2fa3a6491704fcd0d5
-
SHA1
5f45ebddf83bd0dc1ec16a33b8730434f1443de9
-
SHA256
ae887c4a999388cda0d75b30491d336358ec755dda4155c1b29b119417267a97
-
SHA512
1b4400fc83183636e5f0091fdf26c8bad8e3adb302a8769bb98b3fba427a15505533aff1c7f47dcfe2f81cb516a2d1e42a135bb62b3660d404501e73c0e3b94a
-
SSDEEP
49152:ZkrDPn2St9azHKi+SseATlb8P3QtPF+K4wIV4+RPrJvJIHi:ZkrDP2StEHK1SsVTlbZF+K4b6+RPrJvT
Malware Config
Extracted
redline
1w1
135.181.242.178:42473
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99ef8c69ab389d2fa3a6491704fcd0d5.bin
Files
-
99ef8c69ab389d2fa3a6491704fcd0d5.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 19.8MB - Virtual size: 19.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ