meterpreter_reverse_tcp[.]exe | Triage

Sharing

General

Target

meterpreter_reverse_tcp.exe
Size

202KB
MD5

a1573e2db9f83c20e2886d97f4eee85f
SHA1

a579b0396ede82a75411753078a4cd584545641a
SHA256

68aefc809560a457d339528464d540ca74632a96a7bfb021f1f71b780ec03a9d
SHA512

cad69f21ce428136a053b962e348cceb5b6ee4f74961c70ee5c2a2a723f30855fcf7de8750ac50445a77382c8785e7e4b7884b5835d5221f8d35dc9b04d43022
SSDEEP

6144:/8tYebHJCOR1MXTGeBEbW4mO+Zg2jyeL+:/8tY0HJhR1Muqj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
meterpreter_reverse_tcp.exe

Files

meterpreter_reverse_tcp.exe
.exe windows x64

b4c6fff030479aa3b12625be67bf4914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
ExitProcess

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ozcw
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE