metasploit | 2a7405f84563d75bfc075f5a1b1e0e5e

Sharing

Copy URL Twitter E-mail

General

Target

2a7405f84563d75bfc075f5a1b1e0e5e
Size

15.0MB
MD5

2a7405f84563d75bfc075f5a1b1e0e5e
SHA1

00c16eba8687877ace27a07a9f736ee0e7ea657e
SHA256

273c203d4e57f9ccbc87355c588d3aecf5e0e735e7bc2f5aea0321368c8af310
SHA512

3467e2b94ecc94c34b36d16221a015739fbe2a98a7768638801f71ca3d5a8a47dd7cc8e11a7cf21fcde71402546bb4d810e6939b93805a6c21deb940fd24a2c3
SSDEEP

393216:eAsjxrF6R7bYKr46+Ejr0jepar9jQ3TIt:OG/YKCEjr0jok9j1

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_http

http://1.2.3.4:4321/JrC941pZ-wlCmUOYI587SgX7Ir4CDYayGePsoFvvNBGPjONTYv2sz7eQB4sG3MNM_Q509zx_1UBUW2Dl8w1skJ52Cs8tqMwML6rCd1ucTvzk4YJeYHUtNbn8sBDfCajvBakP1Jt1-oO0munAmmy1miA8F2-SQBRFtMEt0r4zrDuxis7eJzBU_yoMQxKzOmMyKcjd97PGmP18mLLXgicr4hV-AU4vvVTkwotVWZSOqmIHM9ThPSLHpjD5P

Signatures

Metasploit family
metasploit

Files

2a7405f84563d75bfc075f5a1b1e0e5e
.exe windows:1 windows x86 arch:x86

Code Sign

0a:f9:3e:ed:64:bf:6b:67:21:3e:3e:d2:c0:a2:0f:e8
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/07/2019, 00:00

Not After

16/02/2021, 12:00

Subject

SERIALNUMBER=91610104MA6U0QWU5L,CN=Xi'an Expand Network Technology Co\, Ltd.,O=Xi'an Expand Network Technology Co\, Ltd.,L=Xi'an,ST=Shaanxi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c06e88eb2e6b996,1.3.6.1.4.1.311.60.2.1.2=#0c06e99995e8a5bf,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:f9:3e:ed:64:bf:6b:67:21:3e:3e:d2:c0:a2:0f:e8
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/07/2019, 00:00

Not After

16/02/2021, 12:00

Subject

SERIALNUMBER=91610104MA6U0QWU5L,CN=Xi'an Expand Network Technology Co\, Ltd.,O=Xi'an Expand Network Technology Co\, Ltd.,L=Xi'an,ST=Shaanxi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c06e88eb2e6b996,1.3.6.1.4.1.311.60.2.1.2=#0c06e99995e8a5bf,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:06:87:57:ba:83:25:1b:91:8f:9a:d0:78:a0:b0:3b:57:42:24:e2:03:22:f9:b0:37:8b:c4:e3:5b:c0:85:1a
Signer

Actual PE Digest

17:06:87:57:ba:83:25:1b:91:8f:9a:d0:78:a0:b0:3b:57:42:24:e2:03:22:f9:b0:37:8b:c4:e3:5b:c0:85:1a

Digest Algorithm

sha256

PE Digest Matches

false

cf:50:47:89:70:7a:b5:5e:8c:65:d4:9e:85:0a:6b:b1:b4:40:cb:ea
Signer

Actual PE Digest

cf:50:47:89:70:7a:b5:5e:8c:65:d4:9e:85:0a:6b:b1:b4:40:cb:ea

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Files

Code Sign

0a:f9:3e:ed:64:bf:6b:67:21:3e:3e:d2:c0:a2:0f:e8Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

0a:f9:3e:ed:64:bf:6b:67:21:3e:3e:d2:c0:a2:0f:e8Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

17:06:87:57:ba:83:25:1b:91:8f:9a:d0:78:a0:b0:3b:57:42:24:e2:03:22:f9:b0:37:8b:c4:e3:5b:c0:85:1aSigner

cf:50:47:89:70:7a:b5:5e:8c:65:d4:9e:85:0a:6b:b1:b4:40:cb:eaSigner

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 41KB - Virtual size: 40KB

DATA Size: 1024B - Virtual size: 592B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 118KB - Virtual size: 117KB

0a:f9:3e:ed:64:bf:6b:67:21:3e:3e:d2:c0:a2:0f:e8
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

0a:f9:3e:ed:64:bf:6b:67:21:3e:3e:d2:c0:a2:0f:e8
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

17:06:87:57:ba:83:25:1b:91:8f:9a:d0:78:a0:b0:3b:57:42:24:e2:03:22:f9:b0:37:8b:c4:e3:5b:c0:85:1a
Signer

cf:50:47:89:70:7a:b5:5e:8c:65:d4:9e:85:0a:6b:b1:b4:40:cb:ea
Signer

CODE
Size: 41KB - Virtual size: 40KB

DATA
Size: 1024B - Virtual size: 592B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 118KB - Virtual size: 117KB