Behavioral task
behavioral1
Sample
94f4ff5cc87f68cd98072e0e738128b6357f0a2281892ab32909ee03b6a36a44.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
94f4ff5cc87f68cd98072e0e738128b6357f0a2281892ab32909ee03b6a36a44.exe
Resource
win10v2004-20240704-en
General
-
Target
5a0fdb64c8a8341aea7dc257c77d841f.bin
-
Size
148KB
-
MD5
1260776eb9936faf44fb91de02be81ce
-
SHA1
e34537e96b4ffbe818395df9e43435d93d6cc2b4
-
SHA256
b256bbb35ac339c5eec254db8b006478cc33a1e8fe945825a3db161de7de9222
-
SHA512
a3192d22ade0eddc57b07b846ae747b20b87bb75c1dbf0d9da44a01f0170d1d68fa67c218eb7f6e8a5dc7f821586328fda1d12efe7ae46c091a05f5b9d8a0c09
-
SSDEEP
3072:vG2qcpnUfaq4CU6xowGS+p9AOskS3h6+gBw1VVZa1YtVSdLv:uapnUCqpzxNGFp9owryVZfVSdLv
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/94f4ff5cc87f68cd98072e0e738128b6357f0a2281892ab32909ee03b6a36a44.exe family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/94f4ff5cc87f68cd98072e0e738128b6357f0a2281892ab32909ee03b6a36a44.exe
Files
-
5a0fdb64c8a8341aea7dc257c77d841f.bin.zip
Password: infected
-
94f4ff5cc87f68cd98072e0e738128b6357f0a2281892ab32909ee03b6a36a44.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 270KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ