Behavioral task
behavioral1
Sample
shell1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
shell1.exe
Resource
win10v2004-20240802-en
General
-
Target
shell1.exe
-
Size
7KB
-
MD5
00d9cdde350b343e9e88b6511caa722b
-
SHA1
5347a2be2a892469c78635bebd60319554d2ad40
-
SHA256
ddf42e5fa52ed0318d0860b354b4d1997336bcaeff68ea238d73f104540caa7f
-
SHA512
e05b5260f7ead93b788b3d0d07cb63fbbca3e73cfac323c0978a9f3814f567fc1f96b96d4a1bb67df7ccde2fc5317ff1a8acab76724d833984674a701efc454b
-
SSDEEP
24:eFGStrJ9u0/6+8PnZdkBQAVb6WcNq9KLqgfGeNDMSCvOXpmB:is0b2kBQa2s9AfGSD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
10.0.2.15:5555
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource shell1.exe
Files
-
shell1.exe.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uamn Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE