C:\CODE\mbae\test\bin\Win32\Release\mbae-test-dll-32.pdb
Behavioral task
behavioral1
Sample
466d0e643397ab0ecb71c4c69853d68ac06278cf01f17260de79036fff6ececf.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
466d0e643397ab0ecb71c4c69853d68ac06278cf01f17260de79036fff6ececf.dll
Resource
win10v2004-20241007-en
General
-
Target
466d0e643397ab0ecb71c4c69853d68ac06278cf01f17260de79036fff6ececf
-
Size
143KB
-
MD5
2261618bf774968326f9d5466216a873
-
SHA1
710eae50692a5c0e8858134f79c315f100fa7ba4
-
SHA256
466d0e643397ab0ecb71c4c69853d68ac06278cf01f17260de79036fff6ececf
-
SHA512
6398f9776313982d04c7c014c3361d08375a55de006481bf9b86bdb8c9b9d58643bff413d20d36eff8d4d751471b1f6c05bf97ec5548ef46ec9391b7df9171e9
-
SSDEEP
3072:gbz5xHll9NHM8mQFA3S4PWRaQtKhkDxBJn:gf5xFl9NNmQa3HCmaX
Malware Config
Extracted
metasploit
windows/download_exec
http://the.earth.li:80/~sgtatham/putty/0.63/x86/putty.exe
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 466d0e643397ab0ecb71c4c69853d68ac06278cf01f17260de79036fff6ececf
Files
-
466d0e643397ab0ecb71c4c69853d68ac06278cf01f17260de79036fff6ececf.dll windows:5 windows x86 arch:x86
fae2a4b40de66be830eef6a4fceec787
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualAlloc
HeapAlloc
LoadLibraryW
HeapDestroy
HeapCreate
VirtualProtectEx
WriteProcessMemory
GetProcAddress
LoadLibraryExW
Sleep
GetCurrentProcessId
InterlockedCompareExchange
IsValidLocale
GetCurrentProcess
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
CreateProcessW
GetLastError
HeapFree
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
IsProcessorFeaturePresent
InterlockedIncrement
InterlockedDecrement
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
RaiseException
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetModuleFileNameW
RtlUnwind
HeapSize
HeapReAlloc
InterlockedExchange
GetLocaleInfoW
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
CreateFileW
CloseHandle
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
InitializeCriticalSection
user32
MessageBoxW
comdlg32
GetOpenFileNameW
advapi32
RegQueryValueExW
RegOpenKeyExW
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ