Behavioral task
behavioral1
Sample
0x0009000000014ed7-61.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
0x0009000000014ed7-61.exe
Resource
win10v2004-20230703-en
General
-
Target
0x0009000000014ed7-61.dat
-
Size
7KB
-
MD5
468f9575a65d99f52fa2b52c505f59a6
-
SHA1
bacb70f9a8abda0e15da98a2289f3ed26062da83
-
SHA256
7e0b5396f1f00177e19b7887137dcc314dccee09f5855c1b6a60129c65310a24
-
SHA512
d701fcd45b785ccfdd60e0bf3829479c41ea52cddfc84078f1efe19340a82041137e66fd4f95ab0772e1821554297d7da482ea4e0502386643b576f073b52094
-
SSDEEP
24:eFGStrJ9u0/6PuU/knZdEBQAVbYfwKLqIGeNDMSCzC/V1ilg9HeH5m+ipmB:is0b0IEBQToHSD9CmtolgJe8SB
Malware Config
Extracted
metasploit
metasploit_stager
104.248.194.233:443
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0009000000014ed7-61.dat
Files
-
0x0009000000014ed7-61.dat.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ftrs Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE