metasploit | cad1b4cc70d77bf0b8613910b48ff525e10bb86dc4149375261633b789a2846b[.]exe | Triage

Sharing

General

Target

cad1b4cc70d77bf0b8613910b48ff525e10bb86dc4149375261633b789a2846b.exe
Size

13KB
MD5

6d55cabcf6b9daf5ff9bfc2c29a22ca6
SHA1

ca4c5534603f1cf4f170eb69ce18cb3571fac6f3
SHA256

cad1b4cc70d77bf0b8613910b48ff525e10bb86dc4149375261633b789a2846b
SHA512

2485688b411e50e191381d561ea3ae9060b75d5dc9c656178990d5d58870c2dcace683b310e339767ab970cebc051721857463defd43b565f7cbd2910f335e18
SSDEEP

384:xrj3J7ePhRBYz6kpb/UO+Wp9bgVDVbdJfm:xZ7evW28b/UvxM

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/exec

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cad1b4cc70d77bf0b8613910b48ff525e10bb86dc4149375261633b789a2846b.exe

Files

cad1b4cc70d77bf0b8613910b48ff525e10bb86dc4149375261633b789a2846b.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\user\source\repos\simpleProcessHollowing\simpleProcessHollowing\obj\Debug\simpleProcessHollowing.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ