Behavioral task
behavioral1
Sample
922301952aca1dd3d6a90ca2aa8c338bc939f27da855dc8013abe98b198d1e1d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
922301952aca1dd3d6a90ca2aa8c338bc939f27da855dc8013abe98b198d1e1d.exe
Resource
win10v2004-20220901-en
General
-
Target
922301952aca1dd3d6a90ca2aa8c338bc939f27da855dc8013abe98b198d1e1d
-
Size
493KB
-
MD5
12be955dfdbec6fea6c8f5b33f004b50
-
SHA1
508bf00c2bcceee6203d10cb0391de7cfea1ecf9
-
SHA256
922301952aca1dd3d6a90ca2aa8c338bc939f27da855dc8013abe98b198d1e1d
-
SHA512
92b661838841fc75d7061e2bdc9873da0cb1a918e02f9abd27e5984bb2cc6a7ccba6635fcb25c99c7aa7197c800382452922c6a80f0e0635950a042bd6c23d18
-
SSDEEP
1536:Dirl2Y0Xkw754Bg98Eq8bEdNFNM8wZsE/IJ1f56BoS4UWO0uf4AERay18FU:KlIXk44iYUEJp1FJ1f56H4UWO0uf4pSU
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
Files
-
922301952aca1dd3d6a90ca2aa8c338bc939f27da855dc8013abe98b198d1e1d.exe windows x86
df18b34b87abebe5196b2ca4a2b92426
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetUserNameA
user32
wsprintfA
CharLowerA
mpr
WNetAddConnection2A
shell32
SHChangeNotify
ShellExecuteExA
ShellExecuteA
ws2_32
send
WSACleanup
connect
sendto
htonl
WSAStartup
gethostname
gethostbyname
inet_addr
shutdown
closesocket
htons
setsockopt
gethostbyaddr
ioctlsocket
recv
socket
iphlpapi
GetAdaptersInfo
wininet
DeleteUrlCacheEntry
InternetCloseHandle
InternetReadFile
HttpSendRequestA
InternetOpenA
HttpOpenRequestA
InternetConnectA
netapi32
NetLocalGroupAddMembers
NetUserAdd
urlmon
URLDownloadToFileA
mfc42
ord823
ord2764
ord4278
ord858
ord6874
ord540
ord860
ord800
ord825
msvcrt
time
_stricmp
memcmp
fread
ftell
fclose
fseek
fopen
fwrite
printf
fprintf
fgets
__dllonexit
_onexit
_exit
_XcptFilter
__CxxFrameHandler
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strchr
strrchr
strcpy
_except_handler3
strcmp
strstr
_snprintf
ceil
strncat
_ftol
sscanf
strtok
_vsnprintf
strlen
malloc
memcpy
free
strcat
strncpy
sprintf
memset
srand
atol
exit
rand
atoi
kernel32
GetSystemDirectoryA
GetSystemInfo
CreateMutexA
SetFileAttributesA
DeleteFileA
ReleaseMutex
GetCurrentProcess
GetDriveTypeA
ExpandEnvironmentStringsA
CreateFileA
GetStartupInfoA
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
lstrcpyA
QueryPerformanceFrequency
QueryPerformanceCounter
GetLogicalDriveStringsA
lstrcatA
CreateDirectoryA
lstrlenA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TransactNamedPipe
ReadFile
CreateEventA
GetShortPathNameA
GetEnvironmentVariableA
SetPriorityClass
SetThreadPriority
SetProcessPriorityBoost
CopyFileA
GetWindowsDirectoryA
GetFileTime
SetFileTime
GetFileAttributesA
TerminateThread
OpenProcess
TerminateProcess
GetCurrentThread
LocalAlloc
LocalFree
WinExec
MultiByteToWideChar
ExitThread
WriteFile
CreateProcessA
lstrcmpiA
CreateThread
Sleep
GetLastError
GetTickCount
GetTempPathA
GetLocaleInfoA
WaitForSingleObject
CloseHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
ExitProcess
GetVersionExA
LoadLibraryA
Sections
.text Size: 476KB - Virtual size: 476KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE