Behavioral task
behavioral1
Sample
0c1ae70e9491b1e5d798b07ac085a245.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0c1ae70e9491b1e5d798b07ac085a245.exe
Resource
win10v2004-20240802-en
General
-
Target
0c1ae70e9491b1e5d798b07ac085a245.virus
-
Size
7KB
-
MD5
0c1ae70e9491b1e5d798b07ac085a245
-
SHA1
7a3a568accd476ae636e09d2ac9b85b90e284687
-
SHA256
632dfd36099795242059771ea0d1053434a482f657508790cfbc87c68217cb1f
-
SHA512
7203cf96e1bb893cd0e929b1d36eb6c409a7e2095e6a114d1639f2c88cd91ded4a20a9f452eb7e4c640fa72731bdb4eddd2672ae09370bc02ffb34dac4dfb807
-
SSDEEP
24:eFGStrJ9u0/64o2RnZdkBQAVoaOxLYKZq6eNDMSCvOXpmB:is0no2hkBQVXxLY0SD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
192.168.0.3:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c1ae70e9491b1e5d798b07ac085a245.virus
Files
-
0c1ae70e9491b1e5d798b07ac085a245.virus.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vjxg Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE