default.rar
- SHA256 f0d41e6f9b749432c807b7d610b610c94caa9a37ed3a049e5872efdde60cbb63
General
- Target default.rar
- Size 996B
- Sample260922-j7nnlsbf56
- SHA256 f0d41e6f9b749432c807b7d610b610c94caa9a37ed3a049e5872efdde60cbb63
- MD5 f9a770ada19100cc2acaa6731a85a529
- SHA1 39ae90feb4e05ff6ae7acb2bce3322c775f93681
- SHA512 5103e2a9aa20ddb96c609ff2ec783dba69c423e060bf01b40a4c422286302966e3c47ce201f2bddc4dd1f13274c5f4bb1b92036706801249520a676831c30ac6
- TLSH T1CD1165AD2C2697B82AA25133D3853A0290A85C2F5040B790E515EF15831559D4EBB3F9
- MD5 SHA1 SHA512 TLSH
Score
10/10
Malware Config
Extracted
Family
-
metasploit
Version
-
metasploit_stager
C2
-
18.118.11.19:4443
Signatures
- Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/default.exe
File Explorer
-
default.rar.rar 996B
-
default.exe.exe 7KB
default.exe
- IMPHASH b4c6fff030479aa3b12625be67bf4914
- SHA256 5aac4afb43e72eb0fc8bd9290e9d11b6084b997b6f067fdc7e22c13f103c75a2
- MD5 3cccad0524f54584fe4096d7d3ab3999
- SHA1 ab729d9c59c4f13bfe2cfcac11386b1a47bcae8b
- SHA512 8c38fe1fe8c01f70347d6dfa5403d4cb71af6d2232218ca953636111a17c27f1e0aafac014d2d20ce3e0e1daafffacf7297901ce93bfaf061cf7d324b07ff94b
- SSDEEP 24:eFGStrJ9u0/6MwWmHnZdkBQAVAWY+4YKZq8eNDMSCvOXpmB:is0sbkBQj+4YmSD9C2kB
- TLSH T1A3E1755337184DB6E8BC067C56E2FD6771584E293F3B82728D280317396212479B4E55
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
VirtualAlloc
ExitProcess
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vrgg
Size
1024B
Virtual Size
632B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=1, productName=Unmarked objects,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,