Behavioral task
behavioral1
Sample
0ce32f695049a33a66b6b44bc081c549e94e397ddc7553add79f9ff6dbfd008e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ce32f695049a33a66b6b44bc081c549e94e397ddc7553add79f9ff6dbfd008e.exe
Resource
win10v2004-20240412-en
General
-
Target
59beadd7101795e5a9afd3e495752f20e6d1702420c221e09c757636d95e180a
-
Size
131KB
-
MD5
e939b9b773809f2090b7d45c5363e7a2
-
SHA1
7b6bb4c0fe3f515fee21a20a348bdfc08ad02e72
-
SHA256
59beadd7101795e5a9afd3e495752f20e6d1702420c221e09c757636d95e180a
-
SHA512
422c130195d549f8033d59a34cb0b040a0c5701000af887773e8dd6777ff34fddb3ad22c978c3cf34165ae8b88d5fe2cc4e6679b7d8c86858fc997e743e3bc6b
-
SSDEEP
3072:ZdD8vvTKsfqYyfLnqMr0jt3K+73tMPe2OLafNLHLsxheJkZZt:ZwvOsN6qMretJ7dQOylLsxheJCZt
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/0ce32f695049a33a66b6b44bc081c549e94e397ddc7553add79f9ff6dbfd008e.exe family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/0ce32f695049a33a66b6b44bc081c549e94e397ddc7553add79f9ff6dbfd008e.exe
Files
-
59beadd7101795e5a9afd3e495752f20e6d1702420c221e09c757636d95e180a.zip
Password: infected
-
0ce32f695049a33a66b6b44bc081c549e94e397ddc7553add79f9ff6dbfd008e.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 307KB - Virtual size: 307KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ