metasploit | 260529-s8e8ashw4l_pw_infected[.]zip

Resubmissions

29/05/2026, 18:13

260529-wt2drses9m

29/05/2026, 16:57

260529-vgd72aas6x10

Sharing

Copy URL Twitter E-mail

General

Target
260529-s8e8ashw4l_pw_infected.zip
Size 44KB
Sample260529-wt2drses9m
SHA256 d8aa5ea103d0b9cbef2a78fc0166bb064e40271dd1ae937dec896deac7356141
MD5 55c0e15a82fa49c8dbd54a412dc3ffc9
SHA1 1cf79dda5f111446142a6390ba15f350d4a043db
SHA512 35778d971beec71a2d158f04e09674b13c16e509c4e755e32a5e1bce34a81bc1f9f74bd5096bb9bc27b3e67d5a66b2ca884b80401f7d280a3120db57d2786e4d
SSDEEP 768:gxhT12UsynNP0IxhTWIBM4g7kr/x4zZcGrDpL3bNaJQxRjFVQqNyN/1NiAQxESkc:gxhT1tRxZgVg/x4tcGrDpL3xaERrQ/ep
TLSH
T1FE23F1C77CB55080FABA0A34D8E5D4155F4E357B2B37C902BA95BBDF0A702087E4A1A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pdf javascript trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

172.20.1.6:4444

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
PDF contains JavaScript
Detects presence of JavaScript in PDF files.
pdf javascript
PDF contains one or more embedded files
Detects presence of embedded files in PDF files.
pdf

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/template.pdf

File Explorer

260529-s8e8ashw4l_pw_infected.zip

.zip 44KB
phishing_malware.pdf

.pdf 45KB
template.pdf

.exe 72KB

260529-s8e8ashw4l_pw_infected.zip

SHA256 d8aa5ea103d0b9cbef2a78fc0166bb064e40271dd1ae937dec896deac7356141
MD5 55c0e15a82fa49c8dbd54a412dc3ffc9
SHA1 1cf79dda5f111446142a6390ba15f350d4a043db
SHA512 35778d971beec71a2d158f04e09674b13c16e509c4e755e32a5e1bce34a81bc1f9f74bd5096bb9bc27b3e67d5a66b2ca884b80401f7d280a3120db57d2786e4d
SSDEEP 768:gxhT12UsynNP0IxhTWIBM4g7kr/x4zZcGrDpL3bNaJQxRjFVQqNyN/1NiAQxESkc:gxhT1tRxZgVg/x4tcGrDpL3xaERrQ/ep
TLSH
T1FE23F1C77CB55080FABA0A34D8E5D4155F4E357B2B37C902BA95BBDF0A702087E4A1A2
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

template.pdf

IMPHASH 481f47bbb2c9c21e108d65f52b04c448
SHA256 3106d1ebaf616fde2f888efc23b12dfb40cf717dc139ff3ca9f3753ed863baeb
MD5 3ed0fca2efb51cd8b39fa1e11d905693
SHA1 f7d4ca4dac494c9ec169f9fd2431f4984456dfdb
SHA512 02914251248a0f2dc21403b7f168e28fe222ea9a26626cdd559499e9702af513ab91dc853b21ee7543de0162da0c362367dbe476cadffa155886e5b4d01aa807
SSDEEP 1536:InuHiV1KDYxaW95m6Mcoze1Pl6yJe/CwJ387ruMb+KR0Nc8QsJq39:iuCV1KDoaoNtSGrue0Nc8QsC9
TLSH
T1E473CF42E5C44426C1A2127D66B53AB5AD74E1FB7201C1DB7A8CCDF9EBC2CB092663C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_iob _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs __p___initenv _XcptFilter _exit _onexit __dllonexit strrchr wcsncmp _close wcslen wcscpy strerror modf strspn realloc __p__environ __p__wenviron _errno free strncmp strstr strncpy _ftol qsort fopen perror fclose fflush calloc malloc signal printf _isctype atoi exit __mb_cur_max _pctype strchr fprintf _controlfp _strdup _strnicmp

kernel32

PeekNamedPipe ReadFile WriteFile LoadLibraryA GetProcAddress GetVersionExA GetExitCodeProcess TerminateProcess LeaveCriticalSection SetEvent ReleaseMutex EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateMutexA GetFileType SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GlobalFree GetCommandLineW TlsAlloc TlsFree DuplicateHandle GetCurrentProcess SetHandleInformation CloseHandle GetSystemTimeAsFileTime FileTimeToSystemTime GetTimeZoneInformation FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime Sleep FormatMessageA GetLastError WaitForSingleObject CreateEventA SetStdHandle SetFilePointer CreateFileA CreateFileW GetOverlappedResult DeviceIoControl GetFileInformationByHandle LocalFree

advapi32

FreeSid AllocateAndInitializeSid

wsock32

getsockopt connect htons gethostbyname ntohl inet_ntoa setsockopt socket closesocket select ioctlsocket __WSAFDIsSet WSAStartup WSACleanup WSAGetLastError

ws2_32

WSARecv WSASend