Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
c91e09f2c5c82a8b5c2922b80dff84d7e7cc6133868edd0edb62b61f8be02a1a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c91e09f2c5c82a8b5c2922b80dff84d7e7cc6133868edd0edb62b61f8be02a1a.exe
Resource
win10v2004-20241007-en
General
-
Target
c91e09f2c5c82a8b5c2922b80dff84d7e7cc6133868edd0edb62b61f8be02a1a
-
Size
446KB
-
MD5
e957f40a02de2630346475f5dae5004c
-
SHA1
a3dbd848a45a3c80235ad626c32568f37f01ea09
-
SHA256
c91e09f2c5c82a8b5c2922b80dff84d7e7cc6133868edd0edb62b61f8be02a1a
-
SHA512
e6a8cd1acf7802b2e2ad955a41ca47ab8690bf243625579920843c858a727ea3ae409be7db2d7d1ad125a7a51d63d8b44bad632ed37789c3e590a6021741108a
-
SSDEEP
12288:xd11vY+PXTwtSbz9KCX7U8pleZ80pGCKry40jy:r11gLt4zkc75pviGCWyh+
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_tcp
192.168.1.18:4444
Signatures
-
Metasploit family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c91e09f2c5c82a8b5c2922b80dff84d7e7cc6133868edd0edb62b61f8be02a1a
Files
-
c91e09f2c5c82a8b5c2922b80dff84d7e7cc6133868edd0edb62b61f8be02a1a.exe windows:4 windows x86 arch:x86
a459cca8021dd3f54b2544fdf61a7556
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
advapi32
RegCloseKey
comctl32
ord17
comdlg32
ChooseFontA
gdi32
Arc
msimg32
GradientFill
ole32
OleInitialize
oleaut32
LoadTypeLi
shell32
ShellExecuteA
user32
GetDC
winmm
waveOutOpen
winspool.drv
OpenPrinterA
ws2_32
accept
Sections
UPX0 Size: - Virtual size: 436KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 395KB - Virtual size: 396KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ