\\192.168.45.226\visualstudio\ConsoleApp2\obj\Release\ConsoleApp2.pdb
Behavioral task
behavioral1
Sample
a7a608476e2acfd1608a988e1dd8a6d0777ffb4789d94bf7b7e0008824a34b56N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a7a608476e2acfd1608a988e1dd8a6d0777ffb4789d94bf7b7e0008824a34b56N.exe
Resource
win10v2004-20241007-en
General
-
Target
a7a608476e2acfd1608a988e1dd8a6d0777ffb4789d94bf7b7e0008824a34b56N
-
Size
6KB
-
MD5
1df6e8787ba2380f3a0cd141961dbe90
-
SHA1
1ce55246ed057b6cb8bda03a85ede02ed9f15d71
-
SHA256
a7a608476e2acfd1608a988e1dd8a6d0777ffb4789d94bf7b7e0008824a34b56
-
SHA512
5c6a2cbb7071209fdab5a37d4d729ed8844bd10692f0e4a7475e8328869817550928a9f97d92eda2c1e3646966716351792954c4d097a8ae2122d66ffcf6dd75
-
SSDEEP
48:6Q0puCN62QRojrgmZkfVKVNMdyQPA22loVtb6OTUYxZeCOOgIypcyjStv54tdt0Z:K62QQE4ShNVt+OThW7jStP40pEzNt
Malware Config
Extracted
metasploit
windows/reverse_http
http://192.168.45.226:443/nbOEKdHrZky3J7Ym0C3N9gTM-POqGJ3bBVAUtRIK5irDgNH6vbHfMHLK2dM0Y3snyMgIi_D6sf-L0IiIwZPAGvnNTaPtXs3dgE7jsDKSjz-mepvAkHqZE0L7cZueU4JZNPVMwqnyxjRYp6-NKyAL0P9an1DLbboPYySi1eB5NFjx8_2gCOQuxnGbVxoEY6Mr-fj7E2_AJsmxC50iGsvrYa
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a7a608476e2acfd1608a988e1dd8a6d0777ffb4789d94bf7b7e0008824a34b56N
Files
-
a7a608476e2acfd1608a988e1dd8a6d0777ffb4789d94bf7b7e0008824a34b56N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ