Behavioral task
behavioral1
Sample
304e48467d70bac60a102460d9fb4dab6116810d83eea6e75a3c7d8804b08a5d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
304e48467d70bac60a102460d9fb4dab6116810d83eea6e75a3c7d8804b08a5d.exe
Resource
win10v2004-20220812-en
General
-
Target
304e48467d70bac60a102460d9fb4dab6116810d83eea6e75a3c7d8804b08a5d
-
Size
1.0MB
-
MD5
08db0b989605596221a656afc1b7184e
-
SHA1
3234e0d1b797fd0cb6f723881b196b34128ede72
-
SHA256
304e48467d70bac60a102460d9fb4dab6116810d83eea6e75a3c7d8804b08a5d
-
SHA512
500477d4e2a29c6d5689f0094bc32f3828111f801abb66c94df6fbd62000aa08c361c49d90816e97b8d0e5617f80d07e81d034e4a2c2d59df07dc76cf2424744
-
SSDEEP
6144:wQs29/htbnhVsTNjLtF7V9+aLBzmWrTSTvb6GYjDiC52F6QHG:wQsgtbhVKHF7Tzm4mvb6GYjG
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
Files
-
304e48467d70bac60a102460d9fb4dab6116810d83eea6e75a3c7d8804b08a5d.exe windows x86
95c57ff4e20ffdec18787933df3643a1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_addr
htons
connect
WSACleanup
WSAStartup
socket
setsockopt
ioctlsocket
bind
listen
select
__WSAFDIsSet
accept
send
recv
closesocket
kernel32
GetCurrentProcess
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
IsBadCodePtr
SetUnhandledExceptionFilter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetLastError
Sleep
CreateThread
GetModuleFileNameA
ExitThread
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
CloseHandle
WriteFile
CreateFileA
ReadFile
SetFilePointer
GetFileSize
GetSystemDirectoryA
MultiByteToWideChar
TransactNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
CreateProcessA
FindClose
FindNextFileA
FindFirstFileA
FreeLibrary
GetEnvironmentVariableW
GetProcAddress
LoadLibraryA
HeapFree
HeapAlloc
GetProcessHeap
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
GetModuleHandleA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
WideCharToMultiByte
GetComputerNameA
CopyFileA
TerminateProcess
lstrcmpiA
DeleteFileA
GetCurrentProcessId
WaitForSingleObject
CreateMutexA
MoveFileA
TerminateThread
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
CreatePipe
SetConsoleCtrlHandler
GetLocaleInfoA
GetVersionExA
GetLogicalDrives
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
InitializeCriticalSection
FatalAppExitA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
LCMapStringA
LCMapStringW
RaiseException
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
Sections
.text Size: 280KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 708KB - Virtual size: 708KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PEPACK!! Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE