Behavioral task
behavioral1
Sample
1644c8496927937f91bec654ee600c85f4d452d075acad2583a0da6a23944336.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1644c8496927937f91bec654ee600c85f4d452d075acad2583a0da6a23944336.exe
Resource
win10v2004-20220901-en
General
-
Target
1644c8496927937f91bec654ee600c85f4d452d075acad2583a0da6a23944336
-
Size
333KB
-
MD5
a15540b12ad5277f5a89df9bfc2ec830
-
SHA1
80b0d62ace005700f2d7def398fda42105f3d377
-
SHA256
1644c8496927937f91bec654ee600c85f4d452d075acad2583a0da6a23944336
-
SHA512
3647504de9a139682244e2b45bbc40008b844bee14fc557da4e3110b9f0e5ddecb6c63e744bb51d6a85d1c92d4852cbd904b839f79453a51e3d53847262d5ded
-
SSDEEP
6144:FLIk+Ng5E0j/1L9f69CxmuOB0129Tlvy67c2kH:FLIyEU/15f69CxmZSMy62H
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/shell_reverse_tcp
192.168.152.128:4444
Signatures
-
Metasploit family
Files
-
1644c8496927937f91bec654ee600c85f4d452d075acad2583a0da6a23944336.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
IWC0 Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IWC1 Size: 203KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE