Behavioral task
behavioral1
Sample
1800-63-0x0000000000400000-0x000000000045A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1800-63-0x0000000000400000-0x000000000045A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1800-63-0x0000000000400000-0x000000000045A000-memory.dmp
-
Size
360KB
-
MD5
666e70add16b42335f566b766a5cdb20
-
SHA1
1dbe8a0265ba371e435241ba479e3a9df6075ff0
-
SHA256
e1fe23972fbf660c8fb769f473744e5697d48b298d877ea564bc7b2fbe908d41
-
SHA512
82abb826706c13fe7a805c8338454862312f887ef8bff4e09f2d15507ddf7cd65a4e30161f9ecb0f878c52f4d64bc91f252d30134e6b29d7e66cea05c3a1fe70
-
SSDEEP
768:Y41xWaIzML06kt5Z2PCYSclhDOQdp7cfgvSm74x/uOw9YSbmUBz1AmsL4WS48VDr:t1xW6LkzZ2NOaptJpzYSbBAmsb80oV1
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
Files
-
1800-63-0x0000000000400000-0x000000000045A000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 302KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ