C:\Users\Myles\source\repos\pdf\obj\x64\Debug\pdf.pdb
Behavioral task
behavioral1
Sample
812adobe_update.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
812adobe_update.exe
Resource
win10v2004-20250314-en
General
-
Target
812adobe_update.exe
-
Size
87KB
-
MD5
3f16a2de1242fc887a4b955300946b50
-
SHA1
94262ade0e49262c1f5e1fb4ad8e3b4a22048013
-
SHA256
41786d15008e2675fbcb8d543647bd6871eeabbb9f4a7f3346aa1f7e786eb7b7
-
SHA512
c51b7e97ccdd52ead4c303219f3eb172859580c3ddd83dab57134d4cb061a01ccada315f5944110015850c101a8975a9e466a9aa4322120344613f1fd4acc124
-
SSDEEP
1536:pAJX27T5dgGQEOLwKhZxlAbd7dkMeDmyOvMt0K3uSqGaVpd:p827T5dKw0AxZwSZ0tP3uRp
Malware Config
Extracted
metasploit
metasploit_stager
51.68.213.100:1440
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 812adobe_update.exe
Files
-
812adobe_update.exe.exe .pdf windows:4 windows x64 arch:x64 polyglot
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ