Behavioral task
behavioral1
Sample
payload-x64.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
payload-x64.exe
Resource
win10v2004-20220901-en
General
-
Target
payload-x64.exe
-
Size
92KB
-
MD5
cad6dd7726668f7618184c90228293fe
-
SHA1
e9f33244ceb00fffa203c0a9e97f8c7671a2ca30
-
SHA256
6fe3bd641e5753aa2bc5d7523e2f0eafa38481ab2a942716d5d3341ccce77395
-
SHA512
97361b79782d303d4272e4fa063ab0c53c9030999f4cb000f02014b9e88ca442115d473585dfa921c1c52b40d4c1563ee0be216ba4301c22f6517734fd545b9c
-
SSDEEP
1536:vGji7tdCdrAxvk7U124B8Tk5FRd3IWRlgkS1yxp1u84XXVuZ0GWoLaeWOgqO+k8+:iEwFCeU1jBqk5Z4OSiP7SXVuZF5aCgqQ
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Metasploit family
Files
-
payload-x64.exe.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.blvc Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE