Behavioral task
behavioral1
Sample
Build2sexe.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Build2sexe.exe
Resource
win10v2004-20230621-en
General
-
Target
Build2sexe.exe
-
Size
3.3MB
-
MD5
1c2b15ed1c8897bb466ec6f1a0f3e815
-
SHA1
b2faf832c9a2e0d7210374560cfff65406659884
-
SHA256
eb405e175ae16fd8877aa87ffdb39f0d4f41cf7c77351708d84f44dd790c35d2
-
SHA512
9df20f4a26972e6bbc5ce2e01a139793077781900f5c304a4239f52d73c1b1653a58f21c725b95371fe5ac4106761dae7b90b71722ee32a87c19517a0d4f8961
-
SSDEEP
98304:4QBNUcwti78OqJ7TPBsHgMWJ0bJpqcV/:/zUcwti7TQlsBWJq1x
Malware Config
Extracted
blackguard
http://94.142.138.111
Signatures
-
Blackguard family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Build2sexe.exe
Files
-
Build2sexe.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ