Behavioral task
behavioral1
Sample
97f51ce17b737a7d6d3d9d204dc57a0c716614e06005ea18ac3033fd15c9c67d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
97f51ce17b737a7d6d3d9d204dc57a0c716614e06005ea18ac3033fd15c9c67d.exe
Resource
win10v2004-20221111-en
General
-
Target
97f51ce17b737a7d6d3d9d204dc57a0c716614e06005ea18ac3033fd15c9c67d
-
Size
940KB
-
MD5
70283f96e714eaa48150489d62ebaadf
-
SHA1
dae878c0e45197a5001c40f3b13f6530cad44368
-
SHA256
97f51ce17b737a7d6d3d9d204dc57a0c716614e06005ea18ac3033fd15c9c67d
-
SHA512
6b7906bac4d4416b44fdf4fc26e55329990c00a1efe4921a6f5afb3debae38b3f7553db9bec2282d4da30831b680a367505d7632f86b77f7d343e0581e49d3c4
-
SSDEEP
12288:EZcW4fnr6DDCblStX57ezLpR12SHehcompObETya9wE1AvcVU2iTcQghlQ4J:ac7D8CpyXJi12S+hcomwbQ9kvRCX
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/shell_reverse_tcp
144.85.149.179:8080
Signatures
-
Metasploit family
Files
-
97f51ce17b737a7d6d3d9d204dc57a0c716614e06005ea18ac3033fd15c9c67d.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 836KB - Virtual size: 833KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ