Overview

overview

10

Static

static

10

c639c49c1f...71.pdf

windows7-x64

10

c639c49c1f...71.pdf

windows10-2004-x64

3

form.exe

windows7-x64

10

form.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c639c49c1fa2c581f4ebd065591f6800f9c0178ad8235768be9fe640d346d471.pdf

  • Size

    58KB

  • MD5

    3adde4fdff788093d385f22601c4488e

  • SHA1

    2ec40ed80fc962ce51c7b3fbe2f9360ba806424f

  • SHA256

    c639c49c1fa2c581f4ebd065591f6800f9c0178ad8235768be9fe640d346d471

  • SHA512

    eeee1c886f4a366523284e47670dc179e95a1eaaed3738fd6e4f614beff178939abbeae04873906b2cb7fb57c48cd378880391dfe30f7893011464c80ee9dbae

  • SSDEEP

    768:TLcuNY8Dgm5XgDzsW1D4DBei8bWcYYy1ZrgtDhDUs1Nt615YNl3HkhNFksBy8DuT:TLcUj5w0W1Dz1biLsSsN8ANuFdtd6

Score
10/10
pdfjavascriptmetasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

10.0.2.15:443

Signatures

  • Metasploit family
    metasploit
  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c639c49c1fa2c581f4ebd065591f6800f9c0178ad8235768be9fe640d346d471.pdf
    .pdf
  • form.pdf
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections