metasploit | 54b9c674ee177e41eea04ab8600207293d437a1345e955489e5042bf016a651d

Sharing

Copy URL

Twitter E-mail

General

Target

54b9c674ee177e41eea04ab8600207293d437a1345e955489e5042bf016a651d
Size

6.4MB
MD5

e6fa1f76bd201537b8998e74f48491ac
SHA1

a06dde6df2faf3e1b3891a45c0947f278ea1aaea
SHA256

54b9c674ee177e41eea04ab8600207293d437a1345e955489e5042bf016a651d
SHA512

9d86ce6ec60469f42954ed272887a13c96c50947d15e8932478483a65db7edba87a2fdf3c1714bb2948bdfb19ab380e1075ad0d9e1719c9d329cdd1acd0c8ef4
SSDEEP

98304:KbWFrzY+MCZrNvRok2Uy9XrLqX58QvZwQwey:9YGrRTkYChey

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.159.129:3333

Signatures

Metasploit family
metasploit

Files

54b9c674ee177e41eea04ab8600207293d437a1345e955489e5042bf016a651d
.exe windows:5 windows x86 arch:x86

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:a8:0a:32:0e:88:48:a3:a4:0a:67:8e:60:ca:3a:ad
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05/06/2024, 00:00

Not After

01/09/2027, 23:59

Subject

CN=Chongqing Zhongcheng Network Technology Co. Ltd.,O=Chongqing Zhongcheng Network Technology Co. Ltd.,ST=Chongqing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

26/09/2024, 00:00

Not After

25/11/2035, 23:59

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:35:cc:e7:97:24:1d:ee:d3:8e:2e:68:31:a2:a1:a5:3a:12:ae:b9:80:c4:6d:58:f7:05:21:c3:19:44:27:69
Signer

Actual PE Digest

8c:35:cc:e7:97:24:1d:ee:d3:8e:2e:68:31:a2:a1:a5:3a:12:ae:b9:80:c4:6d:58:f7:05:21:c3:19:44:27:69

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\ymishra\Documents\GitHub\Dev\target\win\Release\Adobe Download Manager.pdb

Imports

shell32

SHCreateDirectoryExW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetFolderPathW
SHGetFolderLocation
CommandLineToArgvW

shlwapi

UrlIsW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathIsFileSpecW
PathAddExtensionW
PathRenameExtensionW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

HeapSize
HeapQueryInformation
SetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateSemaphoreW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetStringTypeW
GetTimeZoneInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
LCMapStringW
VirtualQuery
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
lstrlenA
CreateMutexW
ReleaseSemaphore
OpenSemaphoreW
ReleaseMutex
GetUserDefaultLangID
GetLocalTime
OpenMutexW
LoadLibraryExA
VirtualAlloc
GetSystemInfo
GetModuleHandleExW
MoveFileExW
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetProfileIntW
SearchPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
SetErrorMode
SetFileAttributesW
GetFileTime
GetFileAttributesExW
FileTimeToLocalFileTime
GlobalGetAtomNameW
FileTimeToSystemTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalFlags
GetThreadLocale
lstrcmpiW
UnlockFile
SetFilePointer
LockFile
GetVolumeInformationW
GetFileSize
FlushFileBuffers
CopyFileW
FormatMessageW
GlobalSize
GlobalFindAtomW
LoadLibraryA
DecodePointer
EncodePointer
RaiseException
GetModuleHandleA
OutputDebugStringA
lstrcpyW
SetDllDirectoryW
SetThreadPriority
FreeResource
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetCurrentThread
InterlockedExchange
GetVersion
GetFileType
GetEnvironmentVariableW
GetStdHandle
GetExitCodeThread
GetFileSizeEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindFirstFileW
GetFileAttributesW
RemoveDirectoryW
GetTempPathW
FindClose
SetFilePointerEx
SetEndOfFile
lstrlenW
DisconnectNamedPipe
GetOverlappedResult
ReadFile
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
WideCharToMultiByte
GetProcessHeap
HeapFree
HeapAlloc
ResumeThread
WriteProcessMemory
DeleteFileW
GetWindowsDirectoryW
DuplicateHandle
VirtualProtectEx
FlushInstructionCache
GetModuleFileNameW
GetSystemDirectoryW
CreateProcessW
SetThreadContext
GetThreadContext
ExitProcess
Sleep
GetTickCount
GetDiskFreeSpaceExW
SetLastError
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
LocalFree
GetCurrentProcessId
LocalAlloc
GetVersionExW
OpenProcess
GetCurrentProcess
FreeLibrary
GetFullPathNameW
CreateThread
CloseHandle
WaitForMultipleObjects
CreateEventW
GlobalFree
MultiByteToWideChar
CreateFileW
WriteFile
SetEvent
WaitForSingleObject
GetCurrentThreadId
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
GetProcAddress
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetModuleHandleW
GetSystemWindowsDirectoryW
IsValidLocale

gdi32

GetTextFaceW
SetPixelV
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
EnumFontFamiliesExW
RoundRect
OffsetRgn
SetDIBColorTable
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
Polyline
Polygon
CreatePolygonRgn
Ellipse
CreateEllipticRgn
CreateDIBSection
CreateRoundRectRgn
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
DPtoLP
SetRectRgn
GetMapMode
GetTextMetricsW
GetRgnBox
GetTextColor
GetBkColor
PatBlt
CreateRectRgnIndirect
GetTextExtentPoint32W
CreateDCW
CopyMetaFileW
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetBkColor
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePatternBrush
CreateHatchBrush
CreateBitmap
GetStockObject
SetPixel
CreateCompatibleBitmap
BitBlt
SetTextColor
DeleteDC
CreateFontIndirectW
GetDeviceCaps
StretchBlt
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
SetMapMode
Rectangle
CreateRectRgn
CreatePen
SetViewportExtEx

advapi32

OpenServiceW
OpenProcessToken
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
SetEntriesInAclW
QueryServiceStatusEx
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenSCManagerW
CloseServiceHandle
ConvertSidToStringSidW
LookupAccountSidW
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
CheckTokenMembership
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegQueryValueExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

ole32

CoCreateInstance
CoCreateGuid
StgCreateDocfileOnILockBytes
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleCreateMenuDescriptor
OleLockRunning
StgOpenStorageOnILockBytes
DoDragDrop
OleRun
CoInitializeEx
StringFromGUID2
CoRegisterMessageFilter
CoGetClassObject
ReleaseStgMedium
OleDuplicateData
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemFree
CoRevokeClassObject
OleUninitialize
CreateILockBytesOnHGlobal
OleInitialize
CoFreeUnusedLibraries
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
CoDisconnectObject
OleDestroyMenuDescriptor
CLSIDFromProgID
CoInitialize
CLSIDFromString

oleaut32

SafeArrayUnaccessData
VarBstrFromDate
LoadTypeLi
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
GetErrorInfo
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
DispCallFunc
LoadRegTypeLi
VariantChangeType
VariantCopy
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

gdiplus

GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipLoadImageFromStream
GdiplusStartup
GdipReleaseDC
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdipFree
GdipDrawImageRectRect
GdiplusShutdown
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipDrawImageI

Exports

Exports

_CreateProcessWithTokenW@36

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 564KB - Virtual size: 563KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

2d17d82ea08a4f178a6a3360e43ce5fd

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:a8:0a:32:0e:88:48:a3:a4:0a:67:8e:60:ca:3a:adCertificate

Extended Key Usages

Key Usages

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

8c:35:cc:e7:97:24:1d:ee:d3:8e:2e:68:31:a2:a1:a5:3a:12:ae:b9:80:c4:6d:58:f7:05:21:c3:19:44:27:69Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

shlwapi

userenv

kernel32

gdi32

advapi32

comctl32

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 564KB - Virtual size: 563KB

.data Size: 31KB - Virtual size: 65KB

.rsrc Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 492KB - Virtual size: 491KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:a8:0a:32:0e:88:48:a3:a4:0a:67:8e:60:ca:3a:ad
Certificate

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

8c:35:cc:e7:97:24:1d:ee:d3:8e:2e:68:31:a2:a1:a5:3a:12:ae:b9:80:c4:6d:58:f7:05:21:c3:19:44:27:69
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 564KB - Virtual size: 563KB

.data
Size: 31KB - Virtual size: 65KB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 492KB - Virtual size: 491KB