Static task
static1
Behavioral task
behavioral1
Sample
bilds.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
bilds.exe
Resource
win10v2004-en-20220112
General
-
Target
bilds.exe
-
Size
1.1MB
-
MD5
7cadb3d6d6581c2bc3642653b9286b71
-
SHA1
ee3a164339db9e2441c035932ae382150f489fb1
-
SHA256
5293c26f29b4af6bc2f3f74ae1ed93537e6c311a695cc0a6920a635c57383617
-
SHA512
db01f9fd60532d121f493c9746dd846e220d8bb110b2bde52655f61a52d0b648f1bb28c7eda4d4c4ccc1066a0b77f7f476f4b558bde11d419abc6aed82f221e1
Malware Config
Extracted
blackguard
https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904
Signatures
-
Blackguard family
Files
-
bilds.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ