Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
dca83a92fde0e4b5ab2bad0f6f8011ad.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dca83a92fde0e4b5ab2bad0f6f8011ad.exe
Resource
win10v2004-20240802-en
General
-
Target
dca83a92fde0e4b5ab2bad0f6f8011ad.virus
-
Size
7KB
-
MD5
dca83a92fde0e4b5ab2bad0f6f8011ad
-
SHA1
e6fc2a7fa068f856da1a9f73f04c5398f2ae3cdf
-
SHA256
f32c192e70453d2c04279a33ec3c217211f67009accf0de02e9e51e59d8f4a43
-
SHA512
2f4667e9651a2bf74e2c055c21c8033f4cf60950d216c49f07662ebe680cb0f074257266ee1029bd2f9896bae7b949b295fcc55a9bfebfd42dd91485ddc906c8
-
SSDEEP
24:eFGStrJ9u0/6u2nZdkBQAV2HaYNq9KZq6eNDMSCvOXpmB:is0LOkBQ3ts90SD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
192.168.0.3:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dca83a92fde0e4b5ab2bad0f6f8011ad.virus
Files
-
dca83a92fde0e4b5ab2bad0f6f8011ad.virus.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uexy Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE