Behavioral task
behavioral1
Sample
068522d08bc23c3294ef90423c21fd99.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
068522d08bc23c3294ef90423c21fd99.exe
Resource
win10v2004-20231215-en
General
-
Target
068522d08bc23c3294ef90423c21fd99.exe
-
Size
7KB
-
MD5
068522d08bc23c3294ef90423c21fd99
-
SHA1
cdb1e769358d6075725cbd9aae446035ff4f23f5
-
SHA256
ac43b68a7e1abb8eb82de818ac4ebcc6f3bbc1d3eb2670f56d3ca341d4df3f40
-
SHA512
e04eb9ab62a08255d82e8a756a795cc0a33e8d750b308f606370969f47e48fc39ed1c0a1ae1d30a0142bf57098cbcd4ca918bcab632d333995291522f6a4d9d1
-
SSDEEP
24:eFGStrJ9u0/6hWnZdkBQAVoaYNq9KZqmeNDMSCvOXpmB:is0AukBQVts9USD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
129.204.96.140:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 068522d08bc23c3294ef90423c21fd99.exe
Files
-
068522d08bc23c3294ef90423c21fd99.exe.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qxeg Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE