Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20221111-en
General
-
Target
tmp
-
Size
5KB
-
MD5
3cc2796dabbad767916d722e5fc9e240
-
SHA1
bbaa3f005822016e697a1d44e0f1a77b49a6b089
-
SHA256
6eee39e75e0b70d9cd08e41eba3961fc0f9512ec43c7e6abd49da68c2ba8285b
-
SHA512
2df38a091f15080dc323ee0dae9fdb7c4f727bd8997fbdd7ad6e4d288b4f5c348af316867f09795b947eb8375dc89c1b1777becc325e8dbe9bbe7afbb5de2378
-
SSDEEP
48:6vvuEKloi1TUCAbHD+lln0DVNMWyZDyoE/ou4ZHNbvKzdxZrbta4RnZsFtoBxlQc:Foi1gOmC8ou4hNMHb/x+p84zzNt
Malware Config
Extracted
metasploit
windows/reverse_http
http://193.37.254.27:33038/IQqc-5QYB3R6HHsdGbNVRgtNH2DEh_WC7LLwxwZFnhAcQTeuAKJBMKuniPTqHFMGjmz
Signatures
-
Metasploit family
Files
-
tmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ