metasploit | a2fda8b479763c27108bba3ebe09ca61 | Triage

Sharing

General

Target

a2fda8b479763c27108bba3ebe09ca61
Size

2KB
MD5

a2fda8b479763c27108bba3ebe09ca61
SHA1

d37350232eddec7ca1ea95f9c72e666fc7a09bb4
SHA256

e32a11c383ef80bae5844b10a419613975582d887b383886c5609ad937c12723
SHA512

162ca285bc614517d24b05c7c69738e141016cfe9b8e479f58b752500bb37f293307fe3605253c05f768c42c08685bae22ca32a42ebff1057396e7aac93b45d7

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.2.3:1337

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2fda8b479763c27108bba3ebe09ca61

Files

a2fda8b479763c27108bba3ebe09ca61
.exe windows:4 windows x86 arch:x86

61cb384c53fe363f36f79f59b5052b66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

strlen
memcpy
printf
_controlfp
__set_app_type
__getmainargs
exit

kernel32

VirtualProtect

Sections

.text
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE