Darkside[.]zip[.]zip | Triage

Resubmissions

02-06-2023 10:03

230602-l3vmgaah67 10

02-06-2023 10:03

230602-l3hb5sah65 3

02-06-2023 09:55

230602-lxwbtaah45 3

Sharing

General

Target

Darkside.zip.zip
Size

31KB
MD5

48fc74ea8d8e8d55f3a053bfa911c147
SHA1

bd668084f4d5eb8a8828af5631b20cd63b996f5f
SHA256

4dcb5d42f6a37cb000de14de346978fa3a9f6a8cd4e41aaec3a15534cc726a1d
SHA512

aa260d640e6d41a3b099a6cc87f5a4f884ad7adf7953346b93bb5f265efcf45dae54cbd7adabfb34ec53465dd6e0972bc61f7e7570c1594598d8ec32d6b93f0e
SSDEEP

768:uQGCmcr7+qYFnCeXRazqghdUq45pZ17EaDdb7p1:ZGCXKNFnC21gc/L7xbX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Darkside.exe

Files

Darkside.zip.zip
.zip

Password: infected
Darkside.zip
.zip

Password: infected
Darkside.exe
.exe windows x86

Password: infected

17a4bd9c95f2898add97f309fc6f9bcd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
ExitProcess

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 374B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ