Behavioral task
behavioral1
Sample
f231f2607087026d06c3b85f49c797e5.exe
Resource
win7-20240221-en
General
-
Target
f231f2607087026d06c3b85f49c797e5.bin
-
Size
192KB
-
MD5
f231f2607087026d06c3b85f49c797e5
-
SHA1
ba6ae9bca027f198b4cd69ab074d5515bfb0e6bc
-
SHA256
7f073652f2f8b23ed985ed50c209580bd0e28a5b4841592e2caea568785fc75d
-
SHA512
9c4c899262e5ad5d75e7784ceeb58c039c5d30ced1d90af7d60a75b0bee9499905c2666f84bc63349341d28f64221760085cf4eafd4841ba707153db4306a747
-
SSDEEP
3072:8O64zyFlJDGx0HqSYxNXUfMim4G3g8e8hE:Yf1s0HZ8em4G3g
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f231f2607087026d06c3b85f49c797e5.bin
Files
-
f231f2607087026d06c3b85f49c797e5.bin.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ