Overview

overview

10

Static

static

10

7f1ac50e9c...03.pdf

windows7-x64

4

7f1ac50e9c...03.pdf

windows10-2004-x64

1

template.exe

windows7-x64

10

template.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    aec9c3d1d62908d5c6189c726038c43f.bin

  • Size

    44KB

  • MD5

    65110c994efe6f6cf6cf2ced92d8cfa3

  • SHA1

    77a3da71cff58aa2d6da7b78b5a2aa9390accb11

  • SHA256

    56e56baa87f6d7ca00de924f93ea0eb1b4b26ee89a90a62f8f0edb31f00abd80

  • SHA512

    dad0f1126ec0d89045e18b29c7bdd76b732604e850e5ab8dfd8f4b94137645de4b0631e6af13546df0c2894dee6d3b04e7c3351466f112a2957e906d4560a2ca

  • SSDEEP

    768:xs3cLsCNJUjRVro99v3D+SpckKmSizRyxuXniSzcgR8NOEqNC+AA9GQJZ:O3c9jUjfro9JD+FkvzRjXiSV+NqNC7AR

Score
10/10
pdfjavascriptmetasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.112.128:4444

Signatures

  • Metasploit family
    metasploit
  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • aec9c3d1d62908d5c6189c726038c43f.bin
    .zip

    Password: infected

  • 7f1ac50e9ce9cf4cadd4b846ddeb0029c2610bb05b6906480819c30ab5ecab03.bin
    .pdf
  • template.pdf
    .exe windows:4 windows x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections