Behavioral task
behavioral1
Sample
4e0d757c3f8d64f78048fe8bd13041f7192b60a0aa9b6fd4d1196d9adb765f92.bin.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4e0d757c3f8d64f78048fe8bd13041f7192b60a0aa9b6fd4d1196d9adb765f92.bin.exe
Resource
win10v2004-20240508-en
General
-
Target
4e0d757c3f8d64f78048fe8bd13041f7192b60a0aa9b6fd4d1196d9adb765f92.bin.exe
-
Size
589KB
-
MD5
2e96b824c62be7ea7f4d9f5659b3d555
-
SHA1
6aa383750400dae2adf590548e13cd5ff77e0467
-
SHA256
4e0d757c3f8d64f78048fe8bd13041f7192b60a0aa9b6fd4d1196d9adb765f92
-
SHA512
5afde4b373d2f211692b2187a3522ac8a82848a3f7c2caa78c6e947a0f366c6061190e6e19b1ac6ebdcd23ad1e5547eaf7c13ab4db7ac9db80e585e08b4bc80e
-
SSDEEP
3072:yO2KddQGiev+bBUDX0/EWzn6SmcX6W+r5zPxKOOmT2fMrDwO5srkUd1R1QxS:12bG3+tls0/mI6jg/M5529PR1H
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_tcp
192.168.1.150:8888
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4e0d757c3f8d64f78048fe8bd13041f7192b60a0aa9b6fd4d1196d9adb765f92.bin.exe
Files
-
4e0d757c3f8d64f78048fe8bd13041f7192b60a0aa9b6fd4d1196d9adb765f92.bin.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 418KB - Virtual size: 417KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ