Behavioral task
behavioral1
Sample
9d8bdd68f839d4c3d1c9d510d34bfa74f00936c8dfe00dcd4ddff43d61305f9f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9d8bdd68f839d4c3d1c9d510d34bfa74f00936c8dfe00dcd4ddff43d61305f9f.exe
Resource
win10v2004-20241007-en
General
-
Target
9d8bdd68f839d4c3d1c9d510d34bfa74f00936c8dfe00dcd4ddff43d61305f9f
-
Size
7KB
-
MD5
0aa404fc301ec5ecfe9f0466bbfe85b7
-
SHA1
c12ca20a6b58062e941511b72b8fab2119daf37d
-
SHA256
9d8bdd68f839d4c3d1c9d510d34bfa74f00936c8dfe00dcd4ddff43d61305f9f
-
SHA512
96b0b0ba2ba90b52c6b835443c839f415d7f7d5e6d26c08600afb17582d74fb3a52f4094db9fe889cfd2f75b34fa4d5011435db7aa05faa75b4047c1eac572e0
-
SSDEEP
24:eFGStrJ9u0/6H7YnZdkBQAVl6WYjGKLqoIeNDMSCvOXpmB:is0A7skBQ4iCFSD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
192.168.98.40:7777
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d8bdd68f839d4c3d1c9d510d34bfa74f00936c8dfe00dcd4ddff43d61305f9f
Files
-
9d8bdd68f839d4c3d1c9d510d34bfa74f00936c8dfe00dcd4ddff43d61305f9f.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gwtk Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE