Behavioral task
behavioral1
Sample
Malicious_888d2d3de85c7a83158ba510fa170c66b4f24e3eefb6669c6c961d065a3d7210.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Malicious_888d2d3de85c7a83158ba510fa170c66b4f24e3eefb6669c6c961d065a3d7210.exe
Resource
win10v2004-20230621-en
General
-
Target
Malicious_888d2d3de85c7a83158ba510fa170c66b4f24e3eefb6669c6c961d065a3d7210.exe
-
Size
68KB
-
MD5
11b06c7e7fe17de7f319e724c8b76cf0
-
SHA1
54fc687a4f7bd5bd51d70c4ad72afa2992279ba7
-
SHA256
888d2d3de85c7a83158ba510fa170c66b4f24e3eefb6669c6c961d065a3d7210
-
SHA512
ee90beeb81e6e94467f2154c52637e3eebfc701eba2c2b27d273a8e565f5a96ae00143fe2c92a12f573e0ef2a5b8a2f553c73d9c58d8934abff3eb53dfb73d05
-
SSDEEP
768:k2DKVFSOVDuyeXoKKtTnoAfHe4Jlz9uHob:5aQ+IYKKxtHe4Jlxu
Malware Config
Extracted
metasploit
windows/exec
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Malicious_888d2d3de85c7a83158ba510fa170c66b4f24e3eefb6669c6c961d065a3d7210.exe
Files
-
Malicious_888d2d3de85c7a83158ba510fa170c66b4f24e3eefb6669c6c961d065a3d7210.exe.exe windows x64
db83ac69fa56b11681633d93f1bf3988
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
WaitForSingleObject
CreateRemoteThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetProcAddress
LoadLibraryA
LoadLibraryW
lstrcmpW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
GetCurrentThreadId
FreeLibrary
user32
MessageBoxA
vcruntime140d
__C_specific_handler
__std_type_info_destroy_list
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__C_specific_handler_noexcept
ucrtbased
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
_cexit
_set_fmode
_exit
_initialize_onexit_table
_initterm_e
_initterm
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
__setusermatherr
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
__stdio_common_vsprintf_s
_register_onexit_function
_seh_filter_dll
strcat_s
strcpy_s
__p__commode
_register_thread_local_exe_atexit_callback
_set_new_mode
exit
_c_exit
_configthreadlocale
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 512B - Virtual size: 275B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ