Behavioral task
behavioral1
Sample
228214776711542d71ed71006001f86aa03f4af0586e01fe2032e84f825d590f.exe
Resource
win7-20240221-en
General
-
Target
228214776711542d71ed71006001f86aa03f4af0586e01fe2032e84f825d590f
-
Size
192KB
-
MD5
1c242a22382d094a4c9a6428e7199759
-
SHA1
4630e243a8f68f4a3162a4a2ee525641a7032be5
-
SHA256
228214776711542d71ed71006001f86aa03f4af0586e01fe2032e84f825d590f
-
SHA512
65c6a682f0c83dd131d70343d7b604811090a9d8a227d7a0b04a82866b0e60e3e3e8f4aac8097d62e5015506e719307a885e94d90b8375a4ed03a86cb75818cf
-
SSDEEP
3072:7WsCziRmKPvwL/2rSlllF+HxN6AtjJXOm8e8hB:7WHqXwaWlllF+CMXOm
Malware Config
Signatures
-
Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_ConfuserEx -
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 228214776711542d71ed71006001f86aa03f4af0586e01fe2032e84f825d590f
Files
-
228214776711542d71ed71006001f86aa03f4af0586e01fe2032e84f825d590f.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ