Static task
static1
Behavioral task
behavioral1
Sample
reverse.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
reverse.exe
Resource
win10v2004-20220414-en
General
-
Target
reverse.exe
-
Size
7KB
-
MD5
835e6f1ae3b45de4d61639f26a678fe8
-
SHA1
3dd088cf9dfe693888037de744104de394c1f085
-
SHA256
9b54f0a2364286a21fa20d02dc02ebeb6b13f8ccaf12ae2fbeaf40350ae6c3e8
-
SHA512
4bebee055add9ea31964d2c97672a7c66e7910afd1a67c6338f963d6e4a718dddb8984b6b7bd39f6aa73ef09a0714765b5c6b864eac9ca8340954c1184151718
-
SSDEEP
24:eFGStrJ9u0/6PRZnZdkBQAVRk4KPqpeNDMSCvOXpmB:is04pkBQN4hSD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
185.247.118.91:443
Signatures
-
Metasploit family
Files
-
reverse.exe.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gpcd Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE