redline | JaffaCakes118_225ad3a67b63f1eab015a6f340a49222 | Triage

Sharing

General

Target

JaffaCakes118_225ad3a67b63f1eab015a6f340a49222
Size

215KB
MD5

225ad3a67b63f1eab015a6f340a49222
SHA1

a758ad4ced5174b4ee7667d12490bded2519de22
SHA256

55ddd5c7a3fcb96a0ef8866bcaf7118b5c391371f7a40e4c61d316e0b8ed9c9d
SHA512

55954c916db953390b1cf95f909ef547bdb7bdc986a05ef548109d13e482b4e892a7630754b89e1a72622a90e9dc2867010ecaed52766237622cc1f2358381da
SSDEEP

3072:rAQ7T4iRRJNaeIsbzPEBFVNFgCNmTY6bFetZfBDMUl8crwC:rAQ7lRbTEBFVvxmTY6bFehDlMC

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

JaffaCakes118_225ad3a67b63f1eab015a6f340a49222
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

28:d8:bd:fc:3c:ee:8c:94:41:5e:bd:51:a7:4d:88:31
Certificate

Issuer

CN=Geare,O=Spoonmeat Adapt Inc.,C=DS,1.2.840.113549.1.9.1=#0c176d756d736563686f697a696e6740676d61696c2e636f6d

Not Before

13-10-2021 21:00

Not After

20-10-2031 21:00

Subject

CN=Geare,O=Spoonmeat Adapt Inc.,C=DS,1.2.840.113549.1.9.1=#0c176d756d736563686f697a696e6740676d61696c2e636f6d

62:7a:9b:72:76:eb:f5:a5:64:7f:46:94:5f:2f:a9:5d:d5:d0:b3:c3
Signer

Actual PE Digest

62:7a:9b:72:76:eb:f5:a5:64:7f:46:94:5f:2f:a9:5d:d5:d0:b3:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ