redline | 1376-63-0x00000000002D0000-0x00000000003DE000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1376-63-0x00000000002D0000-0x00000000003DE000-memory.dmp
Size 1.1MB
Sample240313-gewgmsfh46
SHA256 26412b5f1d5a09493acb49936e2b247caf3874818c7aa5ad5e9ce12cc5ff443d
MD5 72a7c7acc9c289d0977cdb8a12554292
SHA1 33e34511df2e3cec24457089fbb91c4551987620
SHA512 4f14c8ded8d0f429cee0d943b2a512bdf7ee91b96b64997a37ecd4ca40e798c4c9b29cc2c33e4e1aef8d4f3ef4a95301930ee0bfd0d5a37b428dde3143430db0
SSDEEP 12288:VYYzHs5egrXAEGeh+wLL5sJ27umOLcLqqncZEQbf/:52h+8LA2lQbH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline

Malware Config

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1376-63-0x00000000002D0000-0x00000000003DE000-memory.dmp

File Explorer

1376-63-0x00000000002D0000-0x00000000003DE000-memory.dmp

.exe 1.1MB

1376-63-0x00000000002D0000-0x00000000003DE000-memory.dmp

SHA256 26412b5f1d5a09493acb49936e2b247caf3874818c7aa5ad5e9ce12cc5ff443d
MD5 72a7c7acc9c289d0977cdb8a12554292
SHA1 33e34511df2e3cec24457089fbb91c4551987620
SHA512 4f14c8ded8d0f429cee0d943b2a512bdf7ee91b96b64997a37ecd4ca40e798c4c9b29cc2c33e4e1aef8d4f3ef4a95301930ee0bfd0d5a37b428dde3143430db0
SSDEEP 12288:VYYzHs5egrXAEGeh+wLL5sJ27umOLcLqqncZEQbf/:52h+8LA2lQbH
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.textbss

Size

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.BBB

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.Ball

Size

293KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1376-63-0x00000000002D0000-0x00000000003DE000-memory.dmp

generic