DownloadDLL
HWID
HttpGet
IsPremium
Verify
VerifyLogin
_JtSZRomqos@8
_zYeDcizNXv@16
Static task
static1
Behavioral task
behavioral1
Sample
DarkExecutorV4/DarkExecutorV4/DarkExecutorV4/DarkExecutor.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DarkExecutorV4/DarkExecutorV4/DarkExecutorV4/DarkExecutor.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
DarkExecutorV4/DarkExecutorV4/DarkExecutorV4/bin/critexecutor.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
DarkExecutorV4/DarkExecutorV4/DarkExecutorV4/bin/critexecutor.dll
Resource
win10v2004-20230220-en
Target
DarkExecutorV4.zip
Size
4.2MB
MD5
daba8b71f9161d494c10a800e73dc0ee
SHA1
820725b724e349bdf48d219812c04fce3b50b8b8
SHA256
7701ba07ffb05df992541638f7f2b50160b3ccf44096a5ffc67367880e659eef
SHA512
7e0dfc51b38ba201f0340a8db592698b931ed4df98902dab66e1b3c5982948ed40630e9d95dce450ed790448ff44a9a2cddcdf918f2e3e1662e4fad8fc2660bc
SSDEEP
98304:qyhdpS84PU15qUqkITqGaiv+q14rg1d0ECb70TJu4xROXH64:qyhdpS84PU15qU/rdiXsb70MWRV4
Checks for missing Authenticode signature.
resource |
---|
unpack001/DarkExecutorV4/DarkExecutorV4/DarkExecutorV4/DarkExecutor.exe |
unpack001/DarkExecutorV4/DarkExecutorV4/DarkExecutorV4/bin/critexecutor.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Module32FirstW
OutputDebugStringW
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
CreateToolhelp32Snapshot
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoEx
LocalFree
WideCharToMultiByte
GetFileSizeEx
CreateFileA
FormatMessageA
SetLastError
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
WaitForSingleObjectEx
MoveFileExA
GetTickCount
QueryPerformanceCounter
GetEnvironmentVariableA
VerifyVersionInfoA
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
VerSetConditionMask
SleepEx
LeaveCriticalSection
EnterCriticalSection
Module32NextW
MultiByteToWideChar
LoadLibraryA
GetProcAddress
WriteProcessMemory
ReadProcessMemory
VirtualAllocEx
CreateRemoteThread
Sleep
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CloseHandle
GetCurrentProcess
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
CryptEncrypt
CryptGenRandom
CryptCreateHash
CryptHashData
RegGetValueA
RegCreateKeyExW
RegCloseKey
GetCurrentHwProfileA
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptReleaseContext
CryptAcquireContextA
CryptGetHashParam
SysAllocStringLen
SysAllocString
SysFreeString
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Xbad_function_call@std@@YAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
_except_handler4_common
__std_type_info_destroy_list
__current_exception
__std_terminate
strchr
strstr
__current_exception_context
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memset
strrchr
memchr
_execute_onexit_table
_errno
_cexit
_seh_filter_dll
terminate
_initialize_narrow_environment
_register_onexit_function
__sys_nerr
_wassert
_getpid
_configure_narrow_argv
_initterm_e
_initialize_onexit_table
_crt_atexit
_invalid_parameter_noinfo_noreturn
_initterm
_beginthreadex
strerror
isupper
strspn
strcspn
_strdup
strncpy
strncmp
tolower
strpbrk
isalnum
malloc
calloc
_callnewh
free
realloc
strtoul
strtol
atoi
strtoull
strtoll
strtod
ungetc
__stdio_common_vsscanf
fputs
_open
_close
_write
ftell
fgets
fopen
feof
_get_stream_buffer_pointers
_lseeki64
fseek
__acrt_iob_func
__stdio_common_vsprintf_s
fclose
fflush
fgetc
__stdio_common_vsprintf
fgetpos
_read
fputc
setvbuf
fwrite
_fseeki64
fsetpos
fread
_fstat64
_stat64
_unlock_file
_access
_unlink
_lock_file
localeconv
_dclass
_gmtime64
_time64
qsort
ntohl
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertFreeCertificateContext
CertFreeCertificateChain
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
ord46
ord217
ord143
ord211
ord60
ord45
ord50
ord41
ord22
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord26
IdnToAscii
DownloadDLL
HWID
HttpGet
IsPremium
Verify
VerifyLogin
_JtSZRomqos@8
_zYeDcizNXv@16
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ