Behavioral task
behavioral1
Sample
d83054107f5512589ea5f2d140b6deae088142b867626a961216ec5e96154ec9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d83054107f5512589ea5f2d140b6deae088142b867626a961216ec5e96154ec9.exe
Resource
win10v2004-20220812-en
General
-
Target
d83054107f5512589ea5f2d140b6deae088142b867626a961216ec5e96154ec9
-
Size
680KB
-
MD5
631a9dcb31d1e29930686e0a97ab5703
-
SHA1
305727bfea89fa6dc7be1e15e989ed33167f019e
-
SHA256
d83054107f5512589ea5f2d140b6deae088142b867626a961216ec5e96154ec9
-
SHA512
14e7ec52ac28a85cb6affd9ba5524a5ec76442ed235ba13c566bf4a269980f56178c46b56ada0c722f88e7aed10dfd41c9b555d78adac404d7d1034a26da94e1
-
SSDEEP
6144:JgFX4Hlvd5q2Cz44J7bnMMrdsfabo/10ZxP27XiOZD87eWG6XmxMbGdkpw:JTH/MfzX7bRdsfpoSq2MbGdk
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
Files
-
d83054107f5512589ea5f2d140b6deae088142b867626a961216ec5e96154ec9.exe windows x86
7b6caa18486dbf4ea3f85d14381690f8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
FreeLibrary
LocalFree
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetVersionExA
TerminateThread
DeleteFileA
GetTempPathA
CreateFileMappingA
SetFileAttributesA
CopyFileA
MoveFileA
ReadFile
SetFilePointer
GetFileSize
WaitForSingleObject
GetLastError
ExitProcess
lstrcmpiA
MultiByteToWideChar
GetModuleHandleA
QueryPerformanceCounter
QueryPerformanceFrequency
CreateProcessA
WriteFile
GetDriveTypeA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetLocaleInfoA
ExpandEnvironmentStringsA
ReleaseMutex
CreateMutexA
GetProcAddress
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
CreatePipe
GetCurrentProcessId
TerminateProcess
OpenProcess
GetCurrentThread
GlobalMemoryStatus
GetTimeFormatA
GetDateFormatA
GetSystemDirectoryA
LocalAlloc
GetLocalTime
lstrcatA
lstrcpyA
lstrcpynA
lstrcmpA
lstrlenA
GetFileAttributesA
SetFileTime
GetFileTime
GetWindowsDirectoryA
FindClose
FindNextFileA
FindFirstFileA
RemoveDirectoryA
GetComputerNameA
InitializeCriticalSection
IsBadWritePtr
SetHandleCount
HeapReAlloc
VirtualAlloc
CreateFileA
TransactNamedPipe
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ExitThread
GetModuleFileNameA
CreateThread
Sleep
CreateEventA
GetTickCount
VirtualFree
SetEnvironmentVariableA
HeapCreate
CompareStringW
CompareStringA
SetEndOfFile
IsBadCodePtr
IsBadReadPtr
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
HeapSize
LCMapStringW
LCMapStringA
WideCharToMultiByte
GetFileType
GetStdHandle
HeapDestroy
GetEnvironmentVariableA
HeapFree
HeapAlloc
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
RtlUnwind
ResumeThread
TlsSetValue
GetStartupInfoA
GetCommandLineA
GetVersion
RaiseException
GetCurrentThreadId
TlsAlloc
SetLastError
TlsGetValue
user32
wsprintfA
SendMessageA
GetClassNameA
CharLowerA
IsCharAlphaNumericA
advapi32
RegSetValueExA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
GetUserNameA
shell32
ShellExecuteA
ws2_32
connect
socket
bind
getsockname
listen
ntohs
ntohl
select
WSAGetLastError
send
recv
WSASocketA
setsockopt
closesocket
gethostname
htons
htonl
sendto
gethostbyname
inet_ntoa
WSAStartup
ioctlsocket
recvfrom
getsockopt
__WSAFDIsSet
accept
inet_addr
wininet
InternetOpenUrlA
DeleteUrlCacheEntry
mpr
WNetAddConnection2A
oleaut32
GetErrorInfo
Sections
.text Size: 736KB - Virtual size: 736KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE