redline | winPEASx64[.]exe | Triage

Sharing

General

Target

winPEASx64.exe
Size

2.3MB
MD5

1f7f204d5ca9437dbb364b7d28eb71a5
SHA1

5d79c1d2e799596f32a28bb68d966b4efcd608c8
SHA256

39210402176e6bf813dbff36370978a66505dc7a25008841e5225603ccbcb8e6
SHA512

b0782e6c4302fdc5349266adbfcd0865735dbff4874c69e0773deec2afea6062bb37df04d6db9ce46626b9e6fb4474c2e7858556ef6af09a45ca9d1a2d9890be
SSDEEP

24576:ocQmqUZRcomnDIi/W7m/EsH1LsPlNKkThXHL5gZm3T:kmDXmn8i/WaE+El4kBHL5gk

Score

10^/10

redline

Malware Config

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winPEASx64.exe

Files

winPEASx64.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\PEASS-ng\PEASS-ng\winPEAS\winPEASexe\winPEAS\obj\x64\Release\winPEAS.pdb

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ