calc.pdb
Behavioral task
behavioral1
Sample
bff47951616eef6c58a23e2b26b71dadfd3c263a8d9931ac39ff29efc4b42c9f.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bff47951616eef6c58a23e2b26b71dadfd3c263a8d9931ac39ff29efc4b42c9f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bff47951616eef6c58a23e2b26b71dadfd3c263a8d9931ac39ff29efc4b42c9f
-
Size
758KB
-
MD5
74ca33d330c3536d1d0ca4d35971f257
-
SHA1
bbdb8080407ce6a96fa85d4531babd83fc795f79
-
SHA256
bff47951616eef6c58a23e2b26b71dadfd3c263a8d9931ac39ff29efc4b42c9f
-
SHA512
24c45c37d99606d53d0f51c865d3b24458d39250b7470aef15d5585d34e206aafa22273efa3203e32f6633127e9a9150f2ed5af5e46ef1a064860557e8f86d8f
-
SSDEEP
6144:Jv7Wc41yC7dXNBzn68YoC+6VoQSkgrpZHqk61peBN1L+I8pfezYeWHMzyy14pL1k:JvSbxxPRC+XQSxb6Dc7RwIWHeGL7GOK
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
172.16.85.133:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource bff47951616eef6c58a23e2b26b71dadfd3c263a8d9931ac39ff29efc4b42c9f
Files
-
bff47951616eef6c58a23e2b26b71dadfd3c263a8d9931ac39ff29efc4b42c9f.exe windows:6 windows x86 arch:x86
f93b5d76132f6e6068946ec238813ce1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellAboutW
ord165
ShellExecuteExW
shlwapi
ord225
gdiplus
GdipDrawLineI
GdipDrawArcI
GdipFillRectangleI
GdipCloneBrush
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSetPageUnit
GdipCreateSolidFill
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegGetValueW
RegEnumValueW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegCreateKeyExW
RegCloseKey
EventWrite
EventUnregister
EventRegister
oleaut32
SysAllocString
SysStringLen
VariantInit
SysAllocStringByteLen
SysFreeString
VariantClear
uxtheme
IsThemeActive
ole32
CoInitialize
CoUninitialize
CoCreateInstance
comctl32
ImageList_Destroy
ImageList_Add
ImageList_Create
ord413
CreatePropertySheetPageW
PropertySheetW
ord380
ord410
ord392
ntdll
WinSqmAddToStreamEx
WinSqmIncrementDWORD
WinSqmAddToStream
NtQueryLicenseValue
RtlInitUnicodeString
kernel32
lstrlenA
WideCharToMultiByte
GetStartupInfoA
OutputDebugStringA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleW
GetSystemTime
SetEvent
CloseHandle
WaitForSingleObject
CreateThread
CreateEventW
ResetEvent
lstrcmpW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
MulDiv
GlobalFindAtomW
GetLastError
InterlockedDecrement
MultiByteToWideChar
GetLocalTime
GetLocaleInfoW
GetDateFormatW
InterlockedIncrement
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrcmpiW
GetLocaleInfoEx
GetProcAddress
LoadLibraryW
FreeLibrary
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExW
InterlockedExchange
FreeLibraryAndExitThread
GetFileAttributesW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
IsWow64Process
GetCurrentProcess
GetModuleFileNameW
LocalFree
LocalReAlloc
LocalAlloc
GetProfileStringW
lstrlenW
CompareStringW
ApplicationRecoveryInProgress
Sleep
ApplicationRecoveryFinished
RegisterApplicationRecoveryCallback
RegisterApplicationRestart
CompareFileTime
SystemTimeToFileTime
GetTempFileNameW
FileTimeToSystemTime
DeleteFileW
CreateFileW
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
user32
GetSysColor
SetClassLongW
GetClassLongW
DrawMenuBar
SetMenuItemInfoW
AppendMenuW
RemoveMenu
GetSubMenu
GetWindowLongW
InsertMenuItemW
SetWindowLongW
IsWindowEnabled
PostMessageW
CharNextA
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
GetMenuState
IsClipboardFormatAvailable
DefWindowProcW
InvalidateRect
PostQuitMessage
GetFocus
DispatchMessageW
TranslateMessage
GetMessageExtraInfo
TranslateAcceleratorW
GetMessageW
SetForegroundWindow
SetWindowPlacement
RegisterClassExW
DrawTextW
ReleaseDC
GetDC
GetSystemMetrics
EnumChildWindows
SetPropW
GetMenu
CheckRadioButton
UpdateWindow
SendDlgItemMessageW
IsDlgButtonChecked
MoveWindow
GetDlgItemInt
SetDlgItemInt
CheckMenuItem
GetNextDlgTabItem
OffsetRect
GetMonitorInfoW
MonitorFromWindow
CopyRect
IntersectRect
EnumDisplayMonitors
EqualRect
MonitorFromRect
GetClassWord
EnumDesktopWindows
GetProcessDefaultLayout
CreateDialogParamW
TrackPopupMenu
CreatePopupMenu
GetAncestor
FindWindowW
EndDialog
EnableMenuItem
DestroyWindow
MapWindowPoints
GetClassNameW
GetDlgItem
GetWindowRect
SetWindowPos
SendMessageW
LoadCursorW
SetCursor
GetKeyState
IsDialogMessageW
LoadAcceleratorsW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
SetFocus
LoadStringW
SetWindowTextW
GetParent
GetClientRect
ShowWindow
GetWindowPlacement
LoadImageW
UnregisterClassA
FillRect
CheckMenuRadioItem
CreateWindowExW
MessageBeep
SystemParametersInfoW
DialogBoxParamW
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
winmm
timeGetTime
version
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
gdi32
EqualRgn
CreateDIBSection
DeleteObject
DeleteDC
GetTextExtentPointW
CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
GetRgnBox
CreateSolidBrush
GetTextMetricsW
GetTextExtentPoint32W
GetObjectW
LineTo
MoveToEx
ExtCreatePen
CreateCompatibleBitmap
CreateRectRgn
CreateRectRgnIndirect
SetRectRgn
CombineRgn
SelectObject
CreatePatternBrush
SetTextColor
SetBkMode
GetStockObject
SetBkColor
msvcrt
wcsncmp
_wcsnicmp
iswdigit
_wcslwr_s
iswalpha
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
localeconv
memchr
strcspn
sprintf_s
_strtoi64
_strtoui64
_wcsdup
_i64tow_s
_wtoi64
wcsrchr
wcstoul
isalpha
time
difftime
memmove
_callnewh
__pctype_func
___lc_codepage_func
___lc_handle_func
_itow_s
___mb_cur_max_func
setlocale
__crtGetStringTypeW
__crtLCMapStringW
__mb_cur_max
tolower
isspace
abort
isalnum
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
__uncaught_exception
_except_handler4_common
_controlfp
_wtoi
_itoa
calloc
wcschr
_wcsicmp
_vsnwprintf
memcpy
wcscat_s
wcstol
wcscpy_s
exit
mbstowcs_s
toupper
isxdigit
isdigit
_ftol2_sse
memset
_ftol2
malloc
_purecall
free
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
__CxxFrameHandler3
_errno
_wcsrev
Sections
.text Size: 331KB - Virtual size: 331KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 394KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ