Behavioral task
behavioral1
Sample
e673ea6cd9bf1053397e26a014e0da7d9056c23f77bd36aceb2818b0b2ddb366.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
e673ea6cd9bf1053397e26a014e0da7d9056c23f77bd36aceb2818b0b2ddb366.exe
Resource
win10v2004-20231215-en
General
-
Target
e673ea6cd9bf1053397e26a014e0da7d9056c23f77bd36aceb2818b0b2ddb366
-
Size
122KB
-
MD5
3fd56e330582e996c4268eff03aace4c
-
SHA1
7dd911f48d7c550d4c166e7c103d70fea618c784
-
SHA256
e673ea6cd9bf1053397e26a014e0da7d9056c23f77bd36aceb2818b0b2ddb366
-
SHA512
71e809defce81ab31252846f20371912f6ccbf67c5c71b242a7448221e976d19bbfc551809d2c6a6baca8fbb6bc8d104f3f57111fafeeb94ad41fedc472b49d2
-
SSDEEP
3072:DwaK9NUTBVedxNHRW6m7WWAnHY3XQ6uAnHqUQ6:DIPUTBV2RW6m7WWAnHqXQ6uAnHqUQ6
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_tcp
192.168.111.137:5566
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e673ea6cd9bf1053397e26a014e0da7d9056c23f77bd36aceb2818b0b2ddb366
Files
-
e673ea6cd9bf1053397e26a014e0da7d9056c23f77bd36aceb2818b0b2ddb366.exe windows:4 windows x64 arch:x64
6898de8d548c51fb72848bfb1789b496
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
qt5core
_ZN10QArrayData10deallocateEPS_yy
_ZN10QArrayData11shared_nullE
_ZN11QFileDevice5closeEv
_ZN11QMetaObject10ConnectionD1Ev
_ZN11QMetaObject18connectSlotsByNameEP7QObject
_ZN11QMetaObject8activateEP7QObjectPKS_iPPv
_ZN11QTextStreamC1EP9QIODevice
_ZN11QTextStreamD1Ev
_ZN11QTextStreamlsERK7QString
_ZN11QTextStreamlsEc
_ZN11QTextStreamlsEi
_ZN16QCoreApplication12setAttributeEN2Qt20ApplicationAttributeEb
_ZN16QCoreApplication4exitEi
_ZN16QCoreApplication9translateEPKcS1_S1_i
_ZN18QRegularExpressionC1ERK7QString6QFlagsINS_13PatternOptionEE
_ZN18QRegularExpressionD1Ev
_ZN23QRegularExpressionMatchD1Ev
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN5QFileC1ERK7QString
_ZN5QFileD1Ev
_ZN6QDebug9putStringEPK5QChary
_ZN6QDebugD1Ev
_ZN6QMutex4lockEv
_ZN6QMutex6unlockEv
_ZN6QMutexD1Ev
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11connectImplEPKS_PPvS1_S3_PN9QtPrivate15QSlotObjectBaseEN2Qt14ConnectionTypeEPKiPK11QMetaObject
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11deleteLaterEv
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject13setObjectNameERK7QString
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE
_ZN7QString14compare_helperEPK5QChariPKciN2Qt15CaseSensitivityE
_ZN7QString15fromUtf8_helperEPKci
_ZN7QString16fromAscii_helperEPKci
_ZN7QString17fromLatin1_helperEPKci
_ZN7QString6appendERKS_
_ZN7QString6numberEii
_ZN7QStringaSERKS_
_ZN7QThread11qt_metacallEN11QMetaObject4CallEiPPv
_ZN7QThread11qt_metacastEPKc
_ZN7QThread16staticMetaObjectE
_ZN7QThread5eventEP6QEvent
_ZN7QThread5startENS_8PriorityE
_ZN7QThread8finishedENS_14QPrivateSignalE
_ZN7QThreadC2EP7QObject
_ZN7QThreadD2Ev
_ZN8QProcess15waitForFinishedEi
_ZN8QProcess20readAllStandardErrorEv
_ZN8QProcess21readAllStandardOutputEv
_ZN8QProcess5startERK7QStringRK11QStringList6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN8QProcessC1EP7QObject
_ZN8QVariantC1EPKc
_ZN8QVariantC1ERK7QString
_ZN8QVariantC1Ei
_ZN8QVariantD1Ev
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData5eraseEPPv
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData7disposeEPNS_4DataE
_ZN9QListData7reallocEi
_ZN9QtPrivate16QStringList_joinEPK11QStringListPK5QChari
_ZN9QtPrivate20QContainerImplHelper3midEiPiS1_
_ZNK11QMetaObject2trEPKcS1_i
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK14QMessageLogger5debugEPKcz
_ZNK14QMessageLogger5debugEv
_ZNK18QRegularExpression5matchERK7QStringiNS_9MatchTypeE6QFlagsINS_11MatchOptionEE
_ZNK23QRegularExpressionMatch8hasMatchEv
_ZNK7QObject10objectNameEv
_ZNK7QString5splitERKS_NS_13SplitBehaviorEN2Qt15CaseSensitivityE
_ZNK7QString5toIntEPbi
qt5gui
_ZN5QFont12setPointSizeEi
_ZN5QFontC1Ev
_ZN5QFontD1Ev
qt5network
_ZN10QTcpSocketC1EP7QObject
_ZN10QTcpSocketD1Ev
_ZN15QAbstractSocket13connectToHostERK7QStringt6QFlagsIN9QIODevice12OpenModeFlagEENS_20NetworkLayerProtocolE
_ZN15QAbstractSocket16waitForConnectedEi
_ZN15QAbstractSocket5abortEv
qt5sql
_ZN12QSqlDatabase11addDatabaseERK7QStringS2_
_ZN12QSqlDatabase11setHostNameERK7QString
_ZN12QSqlDatabase11setPasswordERK7QString
_ZN12QSqlDatabase11setUserNameERK7QString
_ZN12QSqlDatabase15setDatabaseNameERK7QString
_ZN12QSqlDatabase17defaultConnectionE
_ZN12QSqlDatabase4openEv
_ZN12QSqlDatabase7setPortEi
_ZN12QSqlDatabaseC1Ev
_ZN12QSqlDatabaseD1Ev
_ZN9QSqlErrorD1Ev
_ZN9QSqlQuery4execERK7QString
_ZN9QSqlQuery4execEv
_ZN9QSqlQuery7prepareERK7QString
_ZN9QSqlQuery9bindValueERK7QStringRK8QVariant6QFlagsIN4QSql13ParamTypeFlagEE
_ZN9QSqlQueryC1ERK7QString12QSqlDatabase
_ZN9QSqlQueryD1Ev
_ZNK12QSqlDatabase9lastErrorEv
_ZNK9QSqlError4textEv
qt5widgets
_ZN10QStatusBarC1EP7QWidget
_ZN11QListWidget10insertItemEiP15QListWidgetItem
_ZN11QListWidget5clearEv
_ZN11QListWidgetC1EP7QWidget
_ZN11QMainWindow10setMenuBarEP8QMenuBar
_ZN11QMainWindow11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QMainWindow11qt_metacastEPKc
_ZN11QMainWindow12setStatusBarEP10QStatusBar
_ZN11QMainWindow15createPopupMenuEv
_ZN11QMainWindow16contextMenuEventEP17QContextMenuEvent
_ZN11QMainWindow16setCentralWidgetEP7QWidget
_ZN11QMainWindow16staticMetaObjectE
_ZN11QMainWindow5eventEP6QEvent
_ZN11QMainWindowC2EP7QWidget6QFlagsIN2Qt10WindowTypeEE
_ZN11QMainWindowD2Ev
_ZN11QMessageBox11informationEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_
_ZN11QMessageBox8questionEP7QWidgetRK7QStringS4_6QFlagsINS_14StandardButtonEES6_
_ZN11QPushButtonC1EP7QWidget
_ZN11QTreeWidget13setHeaderItemEP15QTreeWidgetItem
_ZN11QTreeWidget15setHeaderLabelsERK11QStringList
_ZN11QTreeWidget5clearEv
_ZN11QTreeWidgetC1EP7QWidget
_ZN12QApplication4execEv
_ZN12QApplicationC1ERiPPci
_ZN12QApplicationD1Ev
_ZN12QInputDialog7getTextEP7QWidgetRK7QStringS4_N9QLineEdit8EchoModeES4_Pb6QFlagsIN2Qt10WindowTypeEES8_INS9_15InputMethodHintEE
_ZN12QProgressBar12valueChangedEi
_ZN12QProgressBar16staticMetaObjectE
_ZN12QProgressBar8setValueEi
_ZN12QProgressBarC1EP7QWidget
_ZN15QAbstractButton7setTextERK7QString
_ZN15QListWidgetItemC1ERK7QStringP11QListWidgeti
_ZN15QTreeWidgetItemC1EP11QTreeWidgetRK11QStringListi
_ZN15QTreeWidgetItemC1EPS_RK11QStringListi
_ZN15QTreeWidgetItemC1Ei
_ZN16QDialogButtonBox14setOrientationEN2Qt11OrientationE
_ZN16QDialogButtonBox18setStandardButtonsE6QFlagsINS_14StandardButtonEE
_ZN16QDialogButtonBoxC1EP7QWidget
_ZN23QTreeWidgetItemIteratorC1EP15QTreeWidgetItem6QFlagsINS_12IteratorFlagEE
_ZN23QTreeWidgetItemIteratorD1Ev
_ZN23QTreeWidgetItemIteratorppEv
_ZN5QMenu8setTitleERK7QString
_ZN5QMenuC1EP7QWidget
_ZN6QLabel12setAlignmentE6QFlagsIN2Qt13AlignmentFlagEE
_ZN6QLabel7setTextERK7QString
_ZN6QLabelC1EP7QWidget6QFlagsIN2Qt10WindowTypeEE
_ZN7QAction16staticMetaObjectE
_ZN7QAction7setTextERK7QString
_ZN7QAction9triggeredEb
_ZN7QActionC1EP7QObject
_ZN7QDialog10closeEventEP11QCloseEvent
_ZN7QDialog10setVisibleEb
_ZN7QDialog11eventFilterEP7QObjectP6QEvent
_ZN7QDialog11qt_metacallEN11QMetaObject4CallEiPPv
_ZN7QDialog11qt_metacastEPKc
_ZN7QDialog11resizeEventEP12QResizeEvent
_ZN7QDialog13keyPressEventEP9QKeyEvent
_ZN7QDialog16contextMenuEventEP17QContextMenuEvent
_ZN7QDialog16staticMetaObjectE
_ZN7QDialog4doneEi
_ZN7QDialog4execEv
_ZN7QDialog4openEv
_ZN7QDialog6acceptEv
_ZN7QDialog6rejectEv
_ZN7QDialog9showEventEP10QShowEvent
_ZN7QDialogC2EP7QWidget6QFlagsIN2Qt10WindowTypeEE
_ZN7QDialogD2Ev
_ZN7QWidget10enterEventEP6QEvent
_ZN7QWidget10leaveEventEP6QEvent
_ZN7QWidget10paintEventEP11QPaintEvent
_ZN7QWidget10setEnabledEb
_ZN7QWidget10setVisibleEb
_ZN7QWidget10wheelEventEP11QWheelEvent
_ZN7QWidget11actionEventEP12QActionEvent
_ZN7QWidget11changeEventEP6QEvent
_ZN7QWidget11nativeEventERK10QByteArrayPvPl
_ZN7QWidget11resizeEventEP12QResizeEvent
_ZN7QWidget11setGeometryERK5QRect
_ZN7QWidget11tabletEventEP12QTabletEvent
_ZN7QWidget12focusInEventEP11QFocusEvent
_ZN7QWidget13dragMoveEventEP14QDragMoveEvent
_ZN7QWidget13focusOutEventEP11QFocusEvent
_ZN7QWidget13keyPressEventEP9QKeyEvent
_ZN7QWidget14dragEnterEventEP15QDragEnterEvent
_ZN7QWidget14dragLeaveEventEP15QDragLeaveEvent
_ZN7QWidget14mouseMoveEventEP11QMouseEvent
_ZN7QWidget14setWindowTitleERK7QString
_ZN7QWidget15keyReleaseEventEP9QKeyEvent
_ZN7QWidget15mousePressEventEP11QMouseEvent
_ZN7QWidget16inputMethodEventEP17QInputMethodEvent
_ZN7QWidget17mouseReleaseEventEP11QMouseEvent
_ZN7QWidget18focusNextPrevChildEb
_ZN7QWidget18setLayoutDirectionEN2Qt15LayoutDirectionE
_ZN7QWidget19setInputMethodHintsE6QFlagsIN2Qt15InputMethodHintEE
_ZN7QWidget21mouseDoubleClickEventEP11QMouseEvent
_ZN7QWidget4hideEv
_ZN7QWidget4showEv
_ZN7QWidget5closeEv
_ZN7QWidget5eventEP6QEvent
_ZN7QWidget6resizeERK5QSize
_ZN7QWidget7setFontERK5QFont
_ZN7QWidget9addActionEP7QAction
_ZN7QWidget9dropEventEP10QDropEvent
_ZN7QWidget9hideEventEP10QHideEvent
_ZN7QWidget9moveEventEP10QMoveEvent
_ZN7QWidget9showEventEP10QShowEvent
_ZN7QWidgetC1EPS_6QFlagsIN2Qt10WindowTypeEE
_ZN8QMenuBarC1EP7QWidget
_ZN8QSpinBox10setMaximumEi
_ZN8QSpinBox10setMinimumEi
_ZN8QSpinBoxC1EP7QWidget
_ZN9QLineEdit12setInputMaskERK7QString
_ZN9QLineEdit7setTextERK7QString
_ZN9QLineEditC1EP7QWidget
_ZNK11QListWidget5countEv
_ZNK15QAbstractButton4textEv
_ZNK5QMenu10menuActionEv
_ZNK7QDialog15minimumSizeHintEv
_ZNK7QDialog8sizeHintEv
_ZNK7QWidget10redirectedEP6QPoint
_ZNK7QWidget11initPainterEP8QPainter
_ZNK7QWidget11paintEngineEv
_ZNK7QWidget13sharedPainterEv
_ZNK7QWidget14heightForWidthEi
_ZNK7QWidget15minimumSizeHintEv
_ZNK7QWidget16inputMethodQueryEN2Qt16InputMethodQueryE
_ZNK7QWidget17hasHeightForWidthEv
_ZNK7QWidget6metricEN12QPaintDevice17PaintDeviceMetricE
_ZNK7QWidget7devTypeEv
_ZNK7QWidget8sizeHintEv
_ZNK8QSpinBox5valueEv
_ZNK9QLineEdit4textEv
_ZThn16_NK7QWidget10redirectedEP6QPoint
_ZThn16_NK7QWidget11initPainterEP8QPainter
_ZThn16_NK7QWidget11paintEngineEv
_ZThn16_NK7QWidget13sharedPainterEv
_ZThn16_NK7QWidget6metricEN12QPaintDevice17PaintDeviceMetricE
_ZThn16_NK7QWidget7devTypeEv
libgcc_s_seh-1
_Unwind_Resume
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LocalFree
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
LoadLibraryA
GetProcAddress
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strcmp
strlen
strncmp
vfprintf
shell32
CommandLineToArgvW
libstdc++-6
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdaPv
_ZdlPv
_Znay
_Znwy
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_seh0
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE