Static task
static1
Behavioral task
behavioral1
Sample
040a2228a69b6a0d88371fa1454c0765238f85074942b31127bc39d2ebc4fa66.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
040a2228a69b6a0d88371fa1454c0765238f85074942b31127bc39d2ebc4fa66.exe
Resource
win10v2004-20220414-en
General
-
Target
040a2228a69b6a0d88371fa1454c0765238f85074942b31127bc39d2ebc4fa66
-
Size
4KB
-
MD5
6013d05c59b5b496e4c7ff45e40379d6
-
SHA1
96ab8a338933ffec482856e1c12519bbd24cccba
-
SHA256
040a2228a69b6a0d88371fa1454c0765238f85074942b31127bc39d2ebc4fa66
-
SHA512
b011798f74c9b5356a7fa619203e8f9dfa4703265b74b73d59940e2d6b5083146e9129b7740482c1d2d876c3ad3f366dce129aa4ae2e92ee8294e1703d7850d2
-
SSDEEP
96:gAR2/cwi8lSxZtyi4heM3TE58/FikGiOsHN/kF:gjL8OeoA58/FptOst/kF
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_tcp
80.255.3.112:443
Signatures
-
Metasploit family
Files
-
040a2228a69b6a0d88371fa1454c0765238f85074942b31127bc39d2ebc4fa66.exe windows x86
f9ade0aa18f660a34a4fa23392e21838
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ExitProcess
Sections
.text Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE