redline | JaffaCakes118_89c1c59884d9a165d14f8460d986226a | Triage

Sharing

General

Target

JaffaCakes118_89c1c59884d9a165d14f8460d986226a
Size

214KB
MD5

89c1c59884d9a165d14f8460d986226a
SHA1

47ba189fd5925b7ff162f7dab193fb52773ff77d
SHA256

fdb8321fe5919f80f19b679e4f918e707713cf52f734d0815e27a52f7cc19d50
SHA512

53c10412c50b43fc983843e1e3ac92d1be8b3676e3750a8860a5878eac433e109ce003ce05bdd9179b08171a7ba64689ca0d9d444d2cd230ece77794032c803e
SSDEEP

3072:SAWLevD+8Fs3IQ4WMdbjvsO8soImlvUePC1wdik7HPv5uF:SAWLG67MdbjvhNmFUePzdb7pw

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

JaffaCakes118_89c1c59884d9a165d14f8460d986226a
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

1c:82:89:5b:c3:32:e0:84:45:33:63:32:ea:df:80:8f
Certificate

Issuer

CN=Payload,O=Culls Udderful Inc.,C=FM,1.2.840.113549.1.9.1=#0c196a6f72756d706f6c69736861626c6540676d61696c2e636f6d

Not Before

13-10-2021 21:00

Not After

20-10-2031 21:00

Subject

CN=Payload,O=Culls Udderful Inc.,C=FM,1.2.840.113549.1.9.1=#0c196a6f72756d706f6c69736861626c6540676d61696c2e636f6d

6a:77:45:85:74:ae:3b:cf:cc:aa:16:42:4f:30:b6:05:f1:56:57:96
Signer

Actual PE Digest

6a:77:45:85:74:ae:3b:cf:cc:aa:16:42:4f:30:b6:05:f1:56:57:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ