metasploit | 7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce

General

Target
7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce
Size 9KB
Sample240622-r7bm2ssbrd
SHA256 7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce
MD5 cc79b215f87cc6cdca64edf9b28074a5
SHA1 ede77061445292b6d3d4238444ca6f6627d97f82
SHA512 87912217d6ccbe65d35a0910aefd40d66360f4ec6eaaf6301b9706b955b4df8540ead354fa71903bdcb9b5ca5412fa8bb4a118471924c136a3b3d87dd963d2a1
SSDEEP 192:7QqzPsOQrXx6gjjOCK7E5pz6rJoZgGZIgV:7Qlrh6Kju7mOGu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://110.40.195.188:8088/hH6v

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce

File Explorer

7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce

.exe 9KB

7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce

IMPHASH 915e9ffd7926e5faea15041daa79f3ab
SHA256 7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce
MD5 cc79b215f87cc6cdca64edf9b28074a5
SHA1 ede77061445292b6d3d4238444ca6f6627d97f82
SHA512 87912217d6ccbe65d35a0910aefd40d66360f4ec6eaaf6301b9706b955b4df8540ead354fa71903bdcb9b5ca5412fa8bb4a118471924c136a3b3d87dd963d2a1
SSDEEP 192:7QqzPsOQrXx6gjjOCK7E5pz6rJoZgGZIgV:7Qlrh6Kju7mOGu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4705

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\QMQ\source\repos\免杀调试\Release\免杀调试.pdb

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

824B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

344B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

7c34f95770a5c8a036fbccba6db1816159e9ec6548e6afaadafff610fcf6cdce

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic