Behavioral task
behavioral1
Sample
49578d54b8261377cc646e79e2ea3e4b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
49578d54b8261377cc646e79e2ea3e4b.exe
Resource
win10v2004-20231215-en
General
-
Target
49578d54b8261377cc646e79e2ea3e4b
-
Size
1.1MB
-
MD5
49578d54b8261377cc646e79e2ea3e4b
-
SHA1
67a290866336e1a3bdbc23f85f6719957fb27023
-
SHA256
70f1b7a65ec95452ebdf1d415b25c2a2352b076c78ed4db3297ffb6f124003ae
-
SHA512
cb52008a0bcd05993c9830f74b4f0652dd3e9e8cac5e3b9a61dbf39fda563bf5c8755e9cef9430feaa40b4f3ba1d29d49d3097675a673442d67506699f700df5
-
SSDEEP
24576:F6Avzw3wD0chvL2boR5QXGSW6GVryYDjkiFKntRlGl:/vs9G2be5Q2j6GZyYhSbs
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49578d54b8261377cc646e79e2ea3e4b
Files
-
49578d54b8261377cc646e79e2ea3e4b.exe windows:5 windows x86 arch:x86
4db85bf845f78d3968401d3dd78f378d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathAppendW
shell32
ShellExecuteW
kernel32
GetCurrentProcessId
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
ExpandEnvironmentStringsW
GetLastError
CreateFileW
WriteFile
CloseHandle
VirtualAlloc
GetProcAddress
LoadLibraryW
ExitProcess
SetFilePointer
ReadFile
lstrlenW
GetModuleFileNameW
GetFileSize
GetCommandLineW
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
SetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapFree
HeapAlloc
HeapSize
Sleep
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
OutputDebugStringW
HeapReAlloc
WideCharToMultiByte
LCMapStringW
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ