Behavioral task
behavioral1
Sample
vncinjection.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
vncinjection.exe
Resource
win10v2004-20230220-en
General
-
Target
vncinjection.exe
-
Size
7KB
-
MD5
388eb7d72f7c0944872d49367ff6375c
-
SHA1
0e63b6e101fb98da83d3e29d1e0782539104ada6
-
SHA256
c63de17152a7ed7020c63b85227676def72a250f3aeaa969565ba2f314015090
-
SHA512
b8d97d85b94f9f860a4ea350cc94504fecd19677df2c6896c7937adffeefcd4744114aba7dd4deac26cca4c02d33c1f33996170cd21ae7457f22e670c4aca007
-
SSDEEP
24:eFGStrJ9u0/6HA2mnZdkBQAV2GYNwKLq+eNDMSCvOXpmB:is0Av+kBQReeSD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
3.134.39.220:12761
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vncinjection.exe
Files
-
vncinjection.exe.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xrhy Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE