Behavioral task
behavioral1
Sample
86ff7b6af60a513a82784afb0083ea415d24959bdf7ed37f8c67569f80f02e18.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
86ff7b6af60a513a82784afb0083ea415d24959bdf7ed37f8c67569f80f02e18.exe
Resource
win10v2004-20220812-en
General
-
Target
86ff7b6af60a513a82784afb0083ea415d24959bdf7ed37f8c67569f80f02e18
-
Size
275KB
-
MD5
086e353bcd95bc4fcebd894aa6bb9fa1
-
SHA1
f56131f11d04f0e926335fe81683e70a79b5f520
-
SHA256
86ff7b6af60a513a82784afb0083ea415d24959bdf7ed37f8c67569f80f02e18
-
SHA512
c8531d60d7d65896fca345622f981d92bc11610bdf8f0d07f2ca4b2c9a10b1a70e984e68ae4965b3b1105f82d29795f6fbc9fd2a83bc2901e97a67648e4a936c
-
SSDEEP
6144:O9PPY/BPgC6eKSYWoN8sTdGGZAj7afcOdyuRJ:+XY/BPXdKSYWoNUGZAj7at
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
Files
-
86ff7b6af60a513a82784afb0083ea415d24959bdf7ed37f8c67569f80f02e18.exe windows x86
196c7bd4759c787fa6476d0281441544
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_addr
WSACleanup
socket
setsockopt
ioctlsocket
bind
listen
select
__WSAFDIsSet
accept
closesocket
WSAStartup
connect
send
recv
htons
kernel32
TerminateProcess
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
FlushFileBuffers
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
GetFileType
SetHandleCount
Sleep
MultiByteToWideChar
CloseHandle
WriteFile
TransactNamedPipe
CreateFileA
GetLastError
CopyFileA
WideCharToMultiByte
CreateThread
GetModuleFileNameA
ExitThread
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetSystemDirectoryA
GetLocalTime
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetComputerNameA
GetLocaleInfoA
GetVersionExA
DeleteFileA
CreateProcessA
OpenProcess
GetCurrentProcessId
SetFileAttributesA
GetFileAttributesA
ExitProcess
WaitForSingleObject
CreateMutexA
MoveFileA
GetTempPathA
TerminateThread
ReadFile
SetFilePointer
GetFileSize
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
FindClose
FindNextFileA
FindFirstFileA
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
GetCurrentProcess
CreatePipe
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetEnvironmentVariableA
GetLogicalDrives
SetConsoleCtrlHandler
WaitForMultipleObjects
GenerateConsoleCtrlEvent
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatus
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
TlsGetValue
IsBadWritePtr
IsBadReadPtr
HeapValidate
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetStartupInfoA
GetCommandLineA
GetVersion
RaiseException
InitializeCriticalSection
FatalAppExitA
HeapAlloc
DebugBreak
GetStdHandle
OutputDebugStringA
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
user32
BringWindowToTop
SetForegroundWindow
SetFocus
ShowWindow
keybd_event
VkKeyScanA
EnumWindows
GetWindowTextA
GetClassNameA
mpr
WNetAddConnection2A
Sections
.text Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ