Overview

overview

10

Static

static

10

evil.pdf

windows7-x64

10

evil.pdf

windows10-2004-x64

3

1.exe

windows7-x64

10

1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    evil.pdf

  • Size

    263KB

  • MD5

    0370184d49423725fd4d9cf292ab50f0

  • SHA1

    f366cd94dd484ee0653bbb3b0a4f94e7e91a9290

  • SHA256

    cb666fb9180497844f015f390fa97f7fe82f6b7541d6ceca73f2ac52d5a5cab4

  • SHA512

    c052ec86d444f4c60fc65166c633e56f743c56930050447346e417d96593117f32af6f47b86eb02757704b22142a0701e46345348ee227d72fc03ffbc7af72f1

  • SSDEEP

    6144:QIbKOitp0dM3s0FLeNUOL8022Yl1gc2NeXabbuwzV/E/5:rbup3FU7LHClK60x/E/5

Score
10/10
pdfjavascriptmetasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

10.0.2.15:4444

Signatures

  • Metasploit family
    metasploit
  • PDF contains JavaScript

    Detects presence of JavaScript in PDF files.

    pdfjavascript
  • PDF contains one or more embedded files

    Detects presence of embedded files in PDF files.

    pdf
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • evil.pdf
    .pdf
  • 1.pdf
    .exe windows:4 windows x86 arch:x86

    481f47bbb2c9c21e108d65f52b04c448


    Headers

    Imports

    Sections