darkcloud | 0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb

General

Target
0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb
Size 380KB
Sample230807-lbcycaee93
SHA256 0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb
MD5 81f9ef0ad7a89f940d84a211e5bcb1b1
SHA1 10bf03b43269337a10965271575dd767d53374b9
SHA512 1876dd6c8064d22d7996bc0217eb53ae3d1114b241e4f3b08b0af8481a3fb837a3b64da89e8975a8f24de72925b095fbaa86cee015fb9730b5a2f2c71b538a2c
SSDEEP 6144:ehys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:ehys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud

Malware Config

Signatures

Darkcloud family
darkcloud

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb

File Explorer

0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb

.exe 380KB

0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb

IMPHASH 9f29fcb360ef4784abc7f15a21685f98
SHA256 0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb
MD5 81f9ef0ad7a89f940d84a211e5bcb1b1
SHA1 10bf03b43269337a10965271575dd767d53374b9
SHA512 1876dd6c8064d22d7996bc0217eb53ae3d1114b241e4f3b08b0af8481a3fb837a3b64da89e8975a8f24de72925b095fbaa86cee015fb9730b5a2f2c71b538a2c
SSDEEP 6144:ehys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:ehys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13236

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaNextEachAry _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaCyMul __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 ord698 __vbaVarIndexStore __vbaNextEachVar __vbaFreeObjList ord516 __vbaStrErrVarCopy __vbaVarIndexLoadRef _adj_fprem1 ord626 __vbaCopyBytes __vbaStrCat __vbaLsetFixstr ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj ord556 __vbaLenVar ord558 _adj_fdiv_m32 ord666 __vbaAryDestruct __vbaVarXor __vbaLateMemSt __vbaVarIndexLoadRefLock ord593 __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaBoolVar ord520 __vbaBoolVarNull __vbaRefVarAry __vbaVarTstLt _CIsin ord709 __vbaErase ord631 ord525 __vbaVarCmpGt __vbaNextEachCollObj __vbaVarZero ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaGet3 __vbaStrCmp ord529 __vbaPutOwner3 __vbaAryConstruct2 __vbaVarTstEq __vbaDateR8 ord560 __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarLateMemSt __vbaVarOr __vbaFpUI1 ord564 __vbaCastObjVar __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaR8Cy __vbaRedim __vbaUI1ErrVar EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface ord710 __vbaStr2Vec __vbaVarMul __vbaStrUI1 __vbaUI1I4 __vbaExceptHandler __vbaPrintFile ord712 __vbaStrToUnicode __vbaExitEachAry ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 ord531 __vbaFPException ord717 ord532 __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaGetOwner3 __vbaVarCat __vbaDateVar __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaInStr __vbaVar2Vec ord570 __vbaVarLateMemCallLdRf __vbaNew2 _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaVarSetObj __vbaStrCopy ord681 __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaForEachAry __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaVarDup __vbaStrToAnsi __vbaFpI2 ord616 __vbaVarCopy __vbaVarLateMemCallLd __vbaFpI4 __vbaVarSetObjAddref ord617 __vbaLateMemCallLd _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove __vbaStrVarCopy ord619 __vbaForEachVar _allmul __vbaVarLateMemCallSt _CItan __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaI4ErrVar ord580 __vbaRecAssign __vbaFreeStr __vbaFreeObj ord581

Sharing