sessionsploit-main[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sessionsploit-main.zip
Size

418KB
MD5

142a8462d6a4bb3b97a77250d827cb44
SHA1

94effc4988b1cd58a941669e88b9b8e81920053f
SHA256

b18439cb57f3058e54d5b7c4fd0ec9a9948e5c594fc339b95b92ad9f01557d67
SHA512

2ebed4a00f1df003876c499bad847b5f3d6917334d31df306641a676fb69b282b40bd63eda514034978fedb5c2d9cc9eee956dbde3f39ad5fe1cc2ab2a5f3091
SSDEEP

6144:H17kpv8r2YU1/CYNf96magdTqG/fWnZNx+FpXeSBF0gMps6y0dZRfjuunVFwwl:Vk0yrFO93x+FpXeSoL99fxnbB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sessionsploit-main/sessionsploit.exe

Files

sessionsploit-main.zip
.zip
sessionsploit-main/README.md
sessionsploit-main/image.png
.png
sessionsploit-main/sessionsploit.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\boris\source\repos\SessionHijack\obj\Debug\sessionsploit.pdb

Sections

.text
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ