Behavioral task
behavioral1
Sample
efe4fa577a4b7a28ab5d8be469232301.exe
Resource
win7-20240221-en
General
-
Target
efe4fa577a4b7a28ab5d8be469232301.bin
-
Size
192KB
-
MD5
efe4fa577a4b7a28ab5d8be469232301
-
SHA1
f403bcd7e6ee8392996bd81add59624abceba6a5
-
SHA256
5a195b2a88f1cb6fb5045b5429187a3706e17c818a889b8e902bd16d2dfed7a9
-
SHA512
754bfde80a8f90edde7d3cd5ba84835b39704b3527bf1841c37166bace36e375f1a4f52cc187d57a794f232dcfb214befbd668847f88d0f4c71c9d4e7b1cfc64
-
SSDEEP
3072:s47FCYO0NJQ5S0xNcIA7qVJeNGe8e8hy:svd0AEnCVJeNGe
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efe4fa577a4b7a28ab5d8be469232301.bin
Files
-
efe4fa577a4b7a28ab5d8be469232301.bin.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ