Behavioral task
behavioral1
Sample
out(2).exe
Resource
win10-20240404-en
General
-
Target
out(2).exe
-
Size
7KB
-
MD5
74a9401fc600ae6bb3cd602b172059a7
-
SHA1
8f3f0df815f31caf7e6f26371c1b9e0a555df01b
-
SHA256
a1269f6eefff0b0e145d2f319ab988a70f35db6a1cc644eeb8c30732702b332d
-
SHA512
a0c866e6d87c16e88ca6017c35bacbe0ffd3883dc0c1ae54d0b0981641fd1da906c6e4825a2e1dd539adbe088c5ba0e0c5d984b6f730f5768f94def8a7476175
-
SSDEEP
24:eFGStrJ9u0/6/TKxnZdkBQAVtYNq9KZqYeNDMSCvOXpmB:is0S4kBQts9+SD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
54.172.225.3:27844
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource out(2).exe
Files
-
out(2).exe.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mflh Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE