Behavioral task
behavioral1
Sample
c6eeb3e0e3c13e987ce48ddcf1211b20.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6eeb3e0e3c13e987ce48ddcf1211b20.exe
Resource
win10v2004-20240226-en
General
-
Target
c6eeb3e0e3c13e987ce48ddcf1211b20.bin
-
Size
352KB
-
MD5
c6eeb3e0e3c13e987ce48ddcf1211b20
-
SHA1
32317ffa8e786c80d22e2f9f119689d4ac0a75f6
-
SHA256
5546b07ed0e6e7cfe2af9a55c405c2a8cb5183e57e75382a9075537a1fd39410
-
SHA512
82f607037241cd0bf8a22778b69287846a494a66b166e8bf7dbeba9ebaf80afddf70fde6a31f82b9e425f4070727baa4a8fa9e7170786147d4c438ea82d3daaf
-
SSDEEP
6144:eH7ey6f6MsyPU+so4EoqjN9WousfOcAeRJBvMg4LbpoS1:eH7h6SMscU98oq3rfOHeRJBV4ZoS
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6eeb3e0e3c13e987ce48ddcf1211b20.bin
Files
-
c6eeb3e0e3c13e987ce48ddcf1211b20.bin.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ