Behavioral task
behavioral1
Sample
wp64.exe
Resource
win7-20231215-en
General
-
Target
wp64.exe
-
Size
2.3MB
-
MD5
1e6f8ef7e26df09a648103de4bae4576
-
SHA1
541b00e96c9ea5082a86dc70fd782267b3500855
-
SHA256
cac992f0ead92e6195da30bb6952c5642ca91f5ffd839beffa9a655caf2165e2
-
SHA512
17189a930f0f544847f8f37fda73519d9489cbfecfbfb5d2ff40cbfaf93791b5ff6437917da17f1da6daf986318e65c9ccd1aedc542f3afbdac7501c80dc13ce
-
SSDEEP
24576:DcjmcTjtzOkZ/YAhL8vx/KPqti36hBKNKkThXHf5gxLzQ:UmcFHtY4L8vk+xQ4kBHf5gB
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wp64.exe
Files
-
wp64.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ