redline | winPEASx64[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

winPEASx64.exe
Size

1.8MB
MD5

cb746c1db13bdd6c678b3d2db1982bf3
SHA1

10d4a6eb455ec71c742d96ac28dbdf8cee3be46c
SHA256

d89ad95c2f0bb77f17bcdf22b95ae30028835ab96087782fad51c0893519711a
SHA512

05bd4952e17d648a7625ce6df64faa8d2360f8c77b2bfabcd90ded3cae960f0fb867c0d308e7842f17e6eaeee54cf00de0651539691f677287d3a0601f25e2c1
SSDEEP

24576:d4Qneu3RfdGluoIMAC0QashIP8B0p2XggRE:d4KrGluRNC0Qash0Dp2Xg

Score

10^/10

redline

Malware Config

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winPEASx64.exe

Files

winPEASx64.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\PEASS-ng\PEASS-ng\winPEAS\winPEASexe\winPEAS\obj\x64\Release\winPEAS.pdb

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ