metasploit | 45de906887400990878cbae7e96e2e92fd1b0d2b5b24332bc605985389c2a05e

Sharing

Copy URL

Twitter E-mail

General

Target

45de906887400990878cbae7e96e2e92fd1b0d2b5b24332bc605985389c2a05e
Size

6.6MB
MD5

10891eed6b6088103c7f496386c550c1
SHA1

d0f9dc3c51db245bc27fe185f11d28bef7684bd1
SHA256

45de906887400990878cbae7e96e2e92fd1b0d2b5b24332bc605985389c2a05e
SHA512

348d3be736d6fd22c71ad71124bf2e293044a96496d7a21eb2e1249e026b2bf5d70c0343e265d5383fa65430b50b75ce603b470a2a14297f8b8ecd606aa7aaee
SSDEEP

98304:QMql93O0fuCDZhOHtIaeOME0chTMaNxHaDoBPXadAsD+hXoy:QvLrzrON7JQaNxHaVAsD+Fo

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.237.132:5656

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
45de906887400990878cbae7e96e2e92fd1b0d2b5b24332bc605985389c2a05e

Files

45de906887400990878cbae7e96e2e92fd1b0d2b5b24332bc605985389c2a05e
.exe windows:4 windows x86 arch:x86

8de570c6f6a58a1f8da36bc81f19bf75

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\（◆開発用ディレクトリ）\[▼作業用]プログラム\RPGドライブプログラム＋◆Editor - 20180525_ver2.24版_SteamKit版込\Rpgドライブプログラム\Release\Game2.25.pdb

Imports

shlwapi

PathFileExistsA
PathIsDirectoryA

psapi

GetProcessMemoryInfo

kernel32

GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetTickCount
CreateDirectoryA
SetCurrentDirectoryA
FindClose
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetModuleFileNameA
lstrcpyA
GlobalAlloc
GlobalUnlock
GlobalLock
DeleteFileA
CopyFileA
RemoveDirectoryA
CloseHandle
Sleep
GetExitCodeThread
GlobalMemoryStatusEx
OpenProcess
GetCurrentProcessId
GetDiskFreeSpaceExA
lstrlenA
CreateFileA
GetLastError
FreeLibrary
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
RaiseException
GetFileAttributesA
SetUnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
GetSystemInfo
VirtualProtect
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualQuery
UnhandledExceptionFilter
GetTimeZoneInformation
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetOEMCP
GetCPInfo
WriteFile
IsBadWritePtr
VirtualAlloc
GetProcessHeap
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
RtlUnwind
ExitProcess
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetModuleHandleA
TerminateProcess
GetCurrentProcess
MoveFileA
MultiByteToWideChar
LoadLibraryA
DebugBreak
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoA
GetCommandLineA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
ReadFile
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree

user32

SendMessageA
MessageBoxA
ShowWindow
SetWindowPos
GetWindowRect
CreateDialogParamA
SendDlgItemMessageA
GetDC
ReleaseDC
GetCursorPos
MonitorFromPoint
EnumDisplayMonitors
GetMonitorInfoA
ClientToScreen
ClipCursor
GetSystemMetrics
GetScrollPos
GetAsyncKeyState
IsClipboardFormatAvailable
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
DestroyWindow
GetDlgItem
SetFocus

gdi32

RemoveFontResourceExA
AddFontResourceExA
GetDeviceCaps

shell32

ShellExecuteA

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetCloseHandle
InternetOpenA

winmm

timeGetTime

advapi32

RegCloseKey

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Files

8de570c6f6a58a1f8da36bc81f19bf75

Headers

File Characteristics

PDB Paths

Imports

shlwapi

psapi

kernel32

user32

gdi32

shell32

wininet

winmm

advapi32

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 628KB - Virtual size: 627KB

.data Size: 2.0MB - Virtual size: 7.6MB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 628KB - Virtual size: 627KB

.data
Size: 2.0MB - Virtual size: 7.6MB

.rsrc
Size: 4KB - Virtual size: 2KB