Static task
static1
Behavioral task
behavioral1
Sample
SkyDolly.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SkyDolly.exe
Resource
win10v2004-20221111-en
General
-
Target
SkyDolly.exe
-
Size
108KB
-
MD5
958bbb7f991ff4245c655c55d52f1c8b
-
SHA1
6e04e85a4ff07cc101b1d12985cf0f4866af4e7c
-
SHA256
1afb830f13b526fb838052faef4b9a712f5372bab57101132077ee28d1fcb09f
-
SHA512
bc5025902485bc3f9b3b97b291dae61da18d218b6fb1ec367584462f21c518b7c67a18615f8eff47c516c6f92968a1ca641bb677d750f2fc328e255a757b4581
-
SSDEEP
1536:MgG7bJGsWLAt8RNYeH5Kjsuudng9nZiVlRzRkzDp+1G5JBC:EbJI0tQNYeZKR6gpC9kz7JBC
Malware Config
Signatures
Files
-
SkyDolly.exe.exe windows x64
4a3e96f9312f245ba91f8910b4aec544
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
qt6core
_ZN10QArrayData10deallocateEPS_xx
_ZN16QCoreApplication12setAttributeEN2Qt20ApplicationAttributeEb
_ZN16QCoreApplication18setApplicationNameERK7QString
_ZN16QCoreApplication19setOrganizationNameERK7QString
_ZN16QCoreApplication9argumentsEv
_ZN7QStringaSERKS_
qt_version_tag_6_4
qt6widgets
_ZN12QApplication4execEv
_ZN12QApplicationC1ERiPPci
_ZN12QApplicationD1Ev
_ZN7QWidget4showEv
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCommandLineW
GetLastError
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
LocalFree
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
__C_specific_handler
msvcrt
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
shell32
CommandLineToArgvW
libstdc++-6
_ZdaPv
_Znay
_Znwy
__cxa_throw_bad_array_new_length
__gxx_personality_seh0
kernel
_ZN7Version18getApplicationNameEv
_ZN7Version19getOrganisationNameEv
_ZN8Settings15destroyInstanceEv
model
_ZN7Logbook15destroyInstanceEv
persistence
_ZN18PersistenceManager15destroyInstanceEv
pluginmanager
_ZN13PluginManager15destroyInstanceEv
_ZN17SkyConnectManager15destroyInstanceEv
userinterface
_ZN10MainWindowC1ERK7QStringP7QWidget
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 512B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/15 Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/30 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/42 Size: 1024B - Virtual size: 806B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/56 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/68 Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/81 Size: 512B - Virtual size: 187B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/92 Size: 512B - Virtual size: 190B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/108 Size: 512B - Virtual size: 34B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ