redline | JaffaCakes118_5b6b921d63a7952e9d70176a05b9c8af | Triage

Sharing

General

Target

JaffaCakes118_5b6b921d63a7952e9d70176a05b9c8af
Size

214KB
MD5

5b6b921d63a7952e9d70176a05b9c8af
SHA1

c6ed4de1ed8cee54014f07a8db497f4dddba17b2
SHA256

6219a77cc4016dacbcd4045a77f41af1daf4e9cd13c12aaf94bedd951099ad27
SHA512

441bee08681950a2760d754b877d8c1146dbd42b00295c336b9eba885ef25b67c21b878c9bad554bccb7d599e796cdcc0f616285c1701b8b689423977446afbe
SSDEEP

3072:SAWLevD+8Fs3IQ4WMdbjvsO8soImlvUePC1wdik7HPv5uR:SAWLG67MdbjvhNmFUePzdb7pY

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

JaffaCakes118_5b6b921d63a7952e9d70176a05b9c8af
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

1c:82:89:5b:c3:32:e0:84:45:33:63:32:ea:df:80:8f
Certificate

Issuer

CN=Payload,O=Culls Udderful Inc.,C=FM,1.2.840.113549.1.9.1=#0c196a6f72756d706f6c69736861626c6540676d61696c2e636f6d

Not Before

13-10-2021 21:00

Not After

20-10-2031 21:00

Subject

CN=Payload,O=Culls Udderful Inc.,C=FM,1.2.840.113549.1.9.1=#0c196a6f72756d706f6c69736861626c6540676d61696c2e636f6d

40:7b:b9:15:67:c7:5a:45:16:8c:49:d5:17:2e:73:22:24:4f:d2:6e
Signer

Actual PE Digest

40:7b:b9:15:67:c7:5a:45:16:8c:49:d5:17:2e:73:22:24:4f:d2:6e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ