Behavioral task
behavioral1
Sample
rev_44.exe
Resource
win10-20230915-en
General
-
Target
rev_44.exe
-
Size
7KB
-
MD5
a8dfcb0a7db576ab6340b84896537280
-
SHA1
46d5e97ec98fdf530dcd4b540e599b431f814d44
-
SHA256
49bea3f78e22f716b15bdc8e0a4e4c52bc6c945d226b72800f31e3e5837355f4
-
SHA512
9015cc307c00fa7ac418aa4b63a589f63147e4baecdec68b9d0bb4618aedb99b434d7b5318ed3f0aea277db5424524a383dca6c88639d4b4cfe7e69294367440
-
SSDEEP
24:eFGStrJ9u0/6L2onZd0BQAVpOxh7wKPq/eNDMSeXixpmB:is0L80BQrxhMXSD9eS2B
Malware Config
Extracted
metasploit
metasploit_stager
192.168.154.130:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rev_44.exe
Files
-
rev_44.exe.exe windows:4 windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ctqo Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE