Behavioral task
behavioral1
Sample
dd53cc58eefbdc44204474a28c6a7c7cc04cd9a18ca7bed22790faa89d0cbfdc.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dd53cc58eefbdc44204474a28c6a7c7cc04cd9a18ca7bed22790faa89d0cbfdc.exe
Resource
win10v2004-20230915-en
General
-
Target
dd53cc58eefbdc44204474a28c6a7c7cc04cd9a18ca7bed22790faa89d0cbfdc
-
Size
10.7MB
-
MD5
183c5aabf3cb611881c6eeddf22a940b
-
SHA1
3afd92b917a2c12ce70803ece09e3d641f35c795
-
SHA256
dd53cc58eefbdc44204474a28c6a7c7cc04cd9a18ca7bed22790faa89d0cbfdc
-
SHA512
28523af35b2f67ef11ded398f46a311e55f3d522d42376c17e8f904d8a4054282a2b885f2660ed2c7269d75978d3771e3048dacb7812143b1fc4c89ea06dab73
-
SSDEEP
196608:LTIMXkB0i6G5v3kS19tWsdWdgQWAsMNQDzroqrBHXQck34IbE0p4AaYvuGN0awIQ:JkBl6G5v3kS5W++NJYgckIgOAaeuOxJQ
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Metasploit family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd53cc58eefbdc44204474a28c6a7c7cc04cd9a18ca7bed22790faa89d0cbfdc
Files
-
dd53cc58eefbdc44204474a28c6a7c7cc04cd9a18ca7bed22790faa89d0cbfdc.exe windows:6 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE