_.pdb
Behavioral task
behavioral1
Sample
eaa480431db97441a9a511ed9b8a05e255b72d009b249c0e8720c4c09a51a92e.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
eaa480431db97441a9a511ed9b8a05e255b72d009b249c0e8720c4c09a51a92e.dll
Resource
win10v2004-20241007-en
General
-
Target
eaa480431db97441a9a511ed9b8a05e255b72d009b249c0e8720c4c09a51a92e
-
Size
280KB
-
MD5
6211655dd80495c284f1fe390c6667a4
-
SHA1
3d4abcfac18c0e8f7c4517a1cbae4855cb3c4e5c
-
SHA256
eaa480431db97441a9a511ed9b8a05e255b72d009b249c0e8720c4c09a51a92e
-
SHA512
8f74a5761d77dd4f230734f290f612991d7ffc009cf9eae2ed823316594988aeabe6934b41722fe2ef18bde39d37589c62c851e270ee91901b2d1c89378c442c
-
SSDEEP
3072:nKs6jYELp6VFxCvNqKmOl9qkCJM+wbSpvLW9Mo40EG9chzfnXqCYxNn2pU9f2MKP:Ks6j+YNqKmOzKM+wbSpvLWBchTnX
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaa480431db97441a9a511ed9b8a05e255b72d009b249c0e8720c4c09a51a92e
Files
-
eaa480431db97441a9a511ed9b8a05e255b72d009b249c0e8720c4c09a51a92e.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ