metasploit | f0666911f892b61f22ec09cd4bba6d6e60d48ba44b25d50313c7fc2febeddf6b

Sharing

Copy URL Twitter E-mail

General

Target

f0666911f892b61f22ec09cd4bba6d6e60d48ba44b25d50313c7fc2febeddf6b
Size

57KB
MD5

420777b6e7f7475a2bfd76141757e09d
SHA1

699fe1e81d5b775722bf8ce7723f5151a18626f1
SHA256

f0666911f892b61f22ec09cd4bba6d6e60d48ba44b25d50313c7fc2febeddf6b
SHA512

4644ab7d940f0e91b27d470efd1765b1583420b466d31391f6bfa13cef383cf879b5d5679d78f50522d972040592f97f7c7e828323dac891cadce2d6c0ef4215
SSDEEP

768:T4my2s/35ze6md1FH1fAPWdQr4N3k1WcsDTSOMNOa1wd7PsIzBz06iEkWu4rVec+:TG2b6q1Fmri3kEgm7PsI2D8rErZO

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Metasploit family
metasploit

Files

f0666911f892b61f22ec09cd4bba6d6e60d48ba44b25d50313c7fc2febeddf6b
.exe windows x86

a713a07ec9f24fd24d7dd99c3be3b7c5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

GetUserProfileDirectoryA

user32

FindWindowA
CloseClipboard
SetClipboardData
EmptyClipboard
wsprintfA
BlockInput
keybd_event
SetForegroundWindow
SetFocus
ShowWindow
VkKeyScanA
OpenClipboard

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysFreeString
SysAllocString
VariantInit

kernel32

GetStartupInfoA
WideCharToMultiByte
GetLogicalDriveStringsA
GetDriveTypeA
CreateDirectoryA
CopyFileA
CreateMutexA
ReleaseMutex
ExpandEnvironmentStringsA
lstrlenA
lstrcpyA
lstrcmpA
lstrcmpiA
Sleep
CreateThread
GetModuleFileNameA
GetTickCount
ExitThread
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTempPathA
CloseHandle
WaitForSingleObject
ExitProcess
CreateProcessA
WriteFile
CreateFileA
LoadLibraryA
GetFileAttributesA
GetProcAddress
FreeLibrary
GetCurrentProcess
TransactNamedPipe
TerminateThread
GetLocaleInfoA
GetVersionExA
DeleteFileA
SetFileAttributesA
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
GetWindowsDirectoryA
InterlockedDecrement
lstrcpynA

msvcrt

_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_onexit
strncat
sprintf
strlen
_snprintf
rand
memset
strtok
strncpy
srand
memcpy
sscanf
strcmp
strcpy
strrchr
system
strchr
atoi
strcat
free
malloc
fopen
fread
fclose
strstr
fgets
memcmp
strtoul
ftell
fseek
_vsnprintf
??2@YAPAXI@Z
__CxxFrameHandler
_EH_prolog
wcslen
__dllonexit

advapi32

RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
RegOpenKeyExA

ws2_32

WSAStartup

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

a713a07ec9f24fd24d7dd99c3be3b7c5

Headers

File Characteristics

Imports

userenv

user32

ole32

oleaut32

kernel32

msvcrt

advapi32

ws2_32

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 298KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 298KB

.rsrc
Size: 4KB - Virtual size: 4KB