Behavioral task
behavioral1
Sample
service.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
service.exe
Resource
win10v2004-20231020-en
General
-
Target
service.exe
-
Size
106KB
-
MD5
07b4fb169322b75ae6fdfd9b94d48817
-
SHA1
8c7a3bfe0bc7401807e758009b5edd9f67bd52ac
-
SHA256
3110244061baedbf8b6334c390da0a3b974292072f29ed391f847ae67c8ac408
-
SHA512
d0105ba5c4efeec833c8966afc184afdb430e0950bdff928b23d54ae8f98aa4982f75009e0b26c5d86f340dca191a14bb44f9f108e281b2c95463eaee967b5df
-
SSDEEP
1536:cKTBqtFy6Qvi1W8ISkI/2DvPBAeBPFsst6/HLfg8hFwUCl:eGDvUxFMl
Malware Config
Extracted
metasploit
windows/reverse_http
http://127.0.0.1:44444/Ug7-SY2nUeRLJEolLmAQrwKxU3Jn37iKtXH2lwMvIcCVfi_baGhnUhghkyLRF9RX3pcOX_F-xlj6MmShe1DXJMm7MNRuORvkQi59eIgwm5YajHHearJHlqHmVn9WxNman461qxZ
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource service.exe
Files
-
service.exe.exe windows:4 windows x86
fabca1e687926fb9a4094c95299cc3b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
kernel32
CloseHandle
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetThreadContext
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
ResumeThread
SetThreadContext
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualAllocEx
VirtualProtect
VirtualQuery
WriteProcessMemory
msvcrt
__getmainargs
__initenv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_ismbblead
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strlen
strncmp
vfprintf
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 216B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/14 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/29 Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/41 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/55 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/67 Size: 1024B - Virtual size: 707B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/78 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/94 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/110 Size: 512B - Virtual size: 411B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ