Behavioral task
behavioral1
Sample
1476-56-0x0000000000400000-0x0000000000497000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1476-56-0x0000000000400000-0x0000000000497000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1476-56-0x0000000000400000-0x0000000000497000-memory.dmp
-
Size
604KB
-
MD5
41593b16b941814ac3d7f22319ff3968
-
SHA1
28552e21d9b638a6d44254c3eb78a83e62f75357
-
SHA256
dbf44efdb825858f34a94c1365eb8a7a1400716c286349fc573c4d909a4343e0
-
SHA512
2b957a78c99b4fe8a0ff0e19b7065d1b26a6a38a505deb0c529b86eb1aaa794698a1fa7112eac200435135b290e5fc1acb4ae8bcd0c58699274b07e3fd0b4057
-
SSDEEP
12288:SJ3uf7OsQ7UjPHEETmB6RvN52ADa69Qzujwd2ZrIbuSE:jfXjPBTO4NcKjwd2ZrIbo
Malware Config
Extracted
metasploit
windows/reverse_tcp
212.83.163.95:7777
Signatures
-
Metasploit family
Files
-
1476-56-0x0000000000400000-0x0000000000497000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 389KB - Virtual size: 388KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ