Static task
static1
Behavioral task
behavioral1
Sample
f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe
Resource
win10-en-20211208
General
-
Target
f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea
-
Size
568KB
-
MD5
8d1c06ccab35c496556b23dc602b62e3
-
SHA1
33d3b0ec31bfc16dcb1b1ff82550aa17fa4c07c5
-
SHA256
f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea
-
SHA512
cd023f57416334ddd537cd1edea94b7efb235fe09584c78c44283cbd57116abe3cb80a6ae2f5e8fa582d291c3f3adac0e1c62abc201ec6c5594647ac83bb51fd
-
SSDEEP
6144:zCiDk6FE6uUlH4yY0TZaXMwpfUfgWJ/a5kH4mCgisW3:rD/huUlH4yY0NUsgWJ/u07hW3
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_http
http://209.239.115.91:443/6OHEJ
Signatures
-
Metasploit family
Files
-
f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe windows x86
a51df6fd4b6a79817480c776ddef76aa
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
netapi32
NetLocalGroupAddMembers
NetUserDel
NetUserAdd
kernel32
DeleteFileW
ExpandEnvironmentStringsW
GetProcAddress
WriteProcessMemory
LocalFree
CreateFileW
Sleep
LoadLibraryW
CreateProcessW
CloseHandle
GetLastError
GetCurrentProcess
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
VirtualAlloc
GetTickCount
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
UnregisterWaitEx
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
DuplicateHandle
GetCurrentThread
GetCurrentThreadId
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
HeapFree
GetCommandLineA
RaiseException
RtlUnwind
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
InitializeSListHead
GetModuleHandleW
CreateSemaphoreW
CreateThread
ExitThread
LoadLibraryExW
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
LCMapStringW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
OutputDebugStringW
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualFree
VirtualProtect
ReleaseSemaphore
QueryDepthSList
user32
CreateWindowExW
wsprintfW
advapi32
AllocateAndInitializeSid
LookupAccountSidW
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupPrivilegeValueW
RegCreateKeyExW
OpenProcessToken
FreeSid
oleaut32
VariantClear
Sections
.text Size: 155KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 346KB - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ