Behavioral task
behavioral1
Sample
f426f1b8f5679ee2ff93c815298040ef16086237e5dd0308e67eefa56ccd3ca5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f426f1b8f5679ee2ff93c815298040ef16086237e5dd0308e67eefa56ccd3ca5.exe
Resource
win10v2004-20221111-en
General
-
Target
f426f1b8f5679ee2ff93c815298040ef16086237e5dd0308e67eefa56ccd3ca5
-
Size
4KB
-
MD5
bace02e9edecf2b50108774e2587933c
-
SHA1
15f694e6c29466158cdb8c2605c59f83e8a57bb9
-
SHA256
f426f1b8f5679ee2ff93c815298040ef16086237e5dd0308e67eefa56ccd3ca5
-
SHA512
7a7ad7c0d6eddbc265d6a5d12e419b888f815ee753853cd7e13d149a8654e471047dce48b238e6947228fe7fcf7629947ee3dc38ef975827f1839efdddee7883
-
SSDEEP
48:6Nia0B1FRsGsaYZ5tpusnjQgUWnBal1ULwGtpz5DCHZvV7nWJokBOv:gt0HsGsVpdUR2A1UL7pRiTAokI
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/shell_reverse_tcp
1.1.1.1:22000
Signatures
-
Metasploit family
Files
-
f426f1b8f5679ee2ff93c815298040ef16086237e5dd0308e67eefa56ccd3ca5.exe windows x86
f9ade0aa18f660a34a4fa23392e21838
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ExitProcess
Sections
.text Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE