Behavioral task
behavioral1
Sample
b6ac166f7a9d39a7648e30183e91c204d429531e0c2542f082d0d6aa7505c668.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b6ac166f7a9d39a7648e30183e91c204d429531e0c2542f082d0d6aa7505c668.dll
Resource
win10v2004-20240508-en
General
-
Target
b6ac166f7a9d39a7648e30183e91c204d429531e0c2542f082d0d6aa7505c668.exe
-
Size
1.1MB
-
MD5
930ea9bfa702acc1438a42e329d73217
-
SHA1
78cad32d7371f2fccf6517cd7ef9a769ec24c96c
-
SHA256
b6ac166f7a9d39a7648e30183e91c204d429531e0c2542f082d0d6aa7505c668
-
SHA512
cc77e83d8cf7a0ceb5bf4aecc63b693265708dce8709b09ae02d7bd0fa2a142c3bb75927eb6cde3bebcc810a49c34955ea6389e9d37bc72aad21fc5cdeea775c
-
SSDEEP
6144:duzVfMjzfsz4dXpg9JWg1d9CiF2X0lFiJJ6+knHnvAQhW6a6aJdt22HvjP3jL3Iq:oBMjDpg5et2uzTL31dCqa
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6ac166f7a9d39a7648e30183e91c204d429531e0c2542f082d0d6aa7505c668.exe
Files
-
b6ac166f7a9d39a7648e30183e91c204d429531e0c2542f082d0d6aa7505c668.exe.dll windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ