Behavioral task
behavioral1
Sample
083a504054bf5034a40c863a4d1dd489a89fa50cc944f8c71994ec3292e95248.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
083a504054bf5034a40c863a4d1dd489a89fa50cc944f8c71994ec3292e95248.exe
Resource
win10v2004-20240508-en
General
-
Target
083a504054bf5034a40c863a4d1dd489a89fa50cc944f8c71994ec3292e95248.exe
-
Size
7KB
-
MD5
b3e1688a68a66cf3844242de091a1dde
-
SHA1
4c062dd8b7fc98610b9d631d4bbb082f787abb3b
-
SHA256
083a504054bf5034a40c863a4d1dd489a89fa50cc944f8c71994ec3292e95248
-
SHA512
a0ba2400d61fbfddf5348f3d009d3f702816597710e847ec370193ec3d6de16e39fc3b90c4a884bddaa07bea1b28866c182cf01e6db80464ec9d6b1effa530ec
-
SSDEEP
24:eFGStrJ9u0/6hQnZdkBQAVn1Y+BXKLqdeNDMSCvOXpmB:is0wEkBQAq+BX9SD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
94.139.242.7:5454
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 083a504054bf5034a40c863a4d1dd489a89fa50cc944f8c71994ec3292e95248.exe
Files
-
083a504054bf5034a40c863a4d1dd489a89fa50cc944f8c71994ec3292e95248.exe.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wuch Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE