metasploit | 93cbd959ccabc4ed770c8d3a74d8009d

Sharing

Copy URL Twitter E-mail

General

Target
93cbd959ccabc4ed770c8d3a74d8009d
Size 835KB
Sample240206-evgbjsfbe5
SHA256 3afcb7992aa0ab3a3e7ea763b2794892dc321e4eb24c88d79ea18e5eef6c6f67
MD5 93cbd959ccabc4ed770c8d3a74d8009d
SHA1 3a6610b23b659b29ba9f2cd5cf98a0949741b67c
SHA512 ec758fa1c0bdda1255eab09bb885e23c3c237b8084537affe8b109023da1dab21599e9bc34efc315b43e91c97dd9397c3e46819ccab8caae1f962c2828ab8f18
SSDEEP 12288:jvN3gJndPOM68eQeez0aqxJd6DBmSrOAiWedgW4/sMoqw5+NZRGMXmrDjmvKUUIB:j13gJnNiQQSA7Ph8mKvKUWqPkwW+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.1.90:4444

Signatures

Metasploit family
metasploit

File Explorer

93cbd959ccabc4ed770c8d3a74d8009d

.exe 835KB

93cbd959ccabc4ed770c8d3a74d8009d

IMPHASH ddf7967f271d2def449d78bf72166fcb
SHA256 3afcb7992aa0ab3a3e7ea763b2794892dc321e4eb24c88d79ea18e5eef6c6f67
MD5 93cbd959ccabc4ed770c8d3a74d8009d
SHA1 3a6610b23b659b29ba9f2cd5cf98a0949741b67c
SHA512 ec758fa1c0bdda1255eab09bb885e23c3c237b8084537affe8b109023da1dab21599e9bc34efc315b43e91c97dd9397c3e46819ccab8caae1f962c2828ab8f18
SSDEEP 12288:jvN3gJndPOM68eQeez0aqxJd6DBmSrOAiWedgW4/sMoqw5+NZRGMXmrDjmvKUUIB:j13gJnNiQQSA7Ph8mKvKUWqPkwW+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ca:ca:06:b6:f5:8e:4e:bc:7a:89:fd:2b:df:14:10:05:b2:b7:f6:b0:be:ea:2c:0a:df:51:7e:76:c2:8c:cc:3d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Chains

Feb 5, 2024

PE Signature issue

Digest

6c:b4:34:76:30:99:c4:01:3d:19:cd:d5:a7:1b:91:c5:58:be:08:ee

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Chains

Feb 5, 2024

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 19, 2010 - Jan 18, 2038

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Serial Number

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 13, 2018 - Nov 8, 2021

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 19, 2010 - Jan 18, 2038

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

Serial Number

7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 13, 2018 - Nov 8, 2021

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Minor OS version

Major OS version

Entry point

482464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateFontIndirectA CreatePalette CreatePen CreateSolidBrush DeleteDC DeleteObject ExcludeClipRect ExtTextOutA ExtTextOutW GetBkMode GetCharABCWidthsFloatA GetCharWidth32A GetCharWidth32W GetCharWidthA GetCharWidthW GetCharacterPlacementW GetDeviceCaps GetObjectA GetOutlineTextMetricsA GetPixel GetStockObject GetTextExtentExPointA GetTextExtentPoint32A GetTextMetricsA IntersectClipRect LineTo MoveToEx Polyline RealizePalette Rectangle SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetPaletteEntries SetPixel SetTextAlign SetTextColor TextOutA TranslateCharsetInfo UnrealizeObject UpdateColors

user32

AppendMenuA BeginPaint CheckDlgButton CheckMenuItem CheckRadioButton CloseClipboard CreateCaret CreateDialogParamA CreateMenu CreatePopupMenu CreateWindowExA CreateWindowExW DefDlgProcA DefWindowProcA DefWindowProcW DeleteMenu DestroyCaret DestroyIcon DestroyWindow DialogBoxParamA DispatchMessageA DispatchMessageW DrawEdge DrawIconEx EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint FindWindowA FlashWindow GetCapture GetCaretBlinkTime GetClientRect GetClipboardData GetClipboardOwner GetCursorPos GetDC GetDesktopWindow GetDlgItem GetDlgItemTextA GetDoubleClickTime GetForegroundWindow GetKeyboardLayout GetKeyboardState GetMessageA GetMessageTime GetParent GetQueueStatus GetScrollInfo GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowPlacement GetWindowRect GetWindowTextA GetWindowTextLengthA HideCaret InsertMenuA InvalidateRect IsDialogMessageA IsDlgButtonChecked IsIconic IsWindow IsZoomed KillTimer LoadCursorA LoadIconA LoadImageA MapDialogRect MessageBeep MessageBoxA MessageBoxIndirectA MoveWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageA PeekMessageW PostMessageA PostQuitMessage RegisterClassA RegisterClassW RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC ScreenToClient SendDlgItemMessageA SendMessageA SetActiveWindow SetCapture SetCaretPos SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetFocus SetForegroundWindow SetKeyboardState SetScrollInfo SetTimer SetWindowLongA SetWindowPlacement SetWindowPos SetWindowTextA ShowCaret ShowCursor ShowWindow SystemParametersInfoA ToAsciiEx TrackPopupMenu TranslateMessage UpdateWindow

comdlg32

ChooseColorA ChooseFontA GetOpenFileNameA GetSaveFileNameA

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitialize CoUninitialize

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCompositionFontA ImmSetCompositionWindow

advapi32

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyA RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegOpenKeyA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

kernel32

Beep ClearCommBreak CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateThread DecodePointer DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FindResourceA FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommState GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetFileAttributesExA GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathA GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetVersionExA GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatus GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalAlloc LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MulDiv MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlUnwind SetCommBreak SetCommState SetCommTimeouts SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

600KB

Virtual Size

599KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

93cbd959ccabc4ed770c8d3a74d8009d

PE Signature issue

PE Signature issue

gdi32

user32

comdlg32

shell32

ole32

imm32

advapi32

kernel32

generic