rev_shell[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rev_shell.exe
Size

7KB
MD5

effdeab83436eec4a80c13d0c62f738f
SHA1

ce81dc1e72639496b41337d25081211e2f521a6e
SHA256

016ab5feba9b74e690ebd20a0d79ac0c3faee58673793ba56f11303014320e1c
SHA512

30213999c2c5bda1896cd783aafe2eb45a19ec5a1094154494d47196c4ef17ee1d8cab3fa87b23e4beca3fb5a39e34edc12efeb84b66e20d133ecf2d7444d04a
SSDEEP

24:eFGStrJ9u0/6L/LnZdEBQAV8aKq9K9qgeNDJSqUmZEWdXCIGDpmB:is0q/3EBQpE9uSDoqUjWZCSB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rev_shell.exe

Files

rev_shell.exe
.exe windows:4 windows x64

b4c6fff030479aa3b12625be67bf4914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
ExitProcess

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.npll
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE