metasploit | 6c29bc08b1c4fe8692e8f830ff8c4df61d8cecec91890317dff93fb48c08792b

General

Target

6c29bc08b1c4fe8692e8f830ff8c4df61d8cecec91890317dff93fb48c08792b
Size

82KB
MD5

f7c54c6e608ac30220ef843fe4fcf67f
SHA1

6cd64f73a6c4cb32c2c7fe11ade0c8498759a7da
SHA256

6c29bc08b1c4fe8692e8f830ff8c4df61d8cecec91890317dff93fb48c08792b
SHA512

775b321edef3fa709b713c285b2b97635b9c538f799c4e33c6e99d96821f23d2427c1dbff84a5ba3a73868f67ad7dd4e8a6e1529c3e34b05cf2d0f7a4eee39a3
SSDEEP

1536:IeKrdmc+HB1KloCX8TpIzLEwlHlKWPybFO+uM6CAvDBKk:IprgjH7KlXXwbOH85uMzA1Kk

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

Metasploit family
metasploit

Files

6c29bc08b1c4fe8692e8f830ff8c4df61d8cecec91890317dff93fb48c08792b
.exe windows x86

0e73ec669a8245790d02f257deaa91e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

IsValidSid
LookupPrivilegeDisplayNameW
LookupAccountSidW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
LookupPrivilegeNameW
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken

kernel32

FormatMessageW
LoadLibraryExW
GetLastError
CloseHandle
GetCurrentProcess
GetVersion
ExitProcess
TerminateProcess
HeapFree
HeapReAlloc
HeapAlloc
MultiByteToWideChar
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
GetModuleFileNameA
VirtualAlloc
GetProcAddress
LoadLibraryA
LCMapStringA
LCMapStringW
FlushFileBuffers
SetFilePointer
GetStringTypeA
GetStringTypeW
SetStdHandle

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vtyf
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

0e73ec669a8245790d02f257deaa91e9

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.data Size: 10KB - Virtual size: 15KB

.rsrc Size: 1024B - Virtual size: 984B

.vtyf Size: 43KB - Virtual size: 43KB

.text
Size: 26KB - Virtual size: 25KB

.data
Size: 10KB - Virtual size: 15KB

.rsrc
Size: 1024B - Virtual size: 984B

.vtyf
Size: 43KB - Virtual size: 43KB