darkcloud | bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5[.]exe

General

Target
bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5.exe
Size 448KB
Sample230821-h94beadd2w
SHA256 bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5
MD5 15710b09fe672f077e2a4889686258a8
SHA1 706a0b4a44db01c4a1bb9038da32ff9a82b8f8bb
SHA512 926abcc8691d4ae68052d0fc4dad0eabbaa52026ed0b73e0f8147cc39f0a5df8022c7d69b1c295cf50ff3bc42520b3eb7ea236d094fd5ed948802b5d48101992
SSDEEP 6144:jK5nIK54IV2OyPlbh5nf+4a+9vkC7CYfHOn+Re8d1/w5KA81IJ8GpF6nuTmOOU:u3aIVCWAcC7CLn+TjYKkJj6GmZU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot604988038:AAHbCIrKg0mPOZkWXVnoaV9KsVWEMxXjp0M/sendMessage?chat_id=2126102657

Signatures

Darkcloud family
darkcloud

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5.exe

File Explorer

bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5.exe

.exe 448KB

bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5.exe

IMPHASH 86bf44e6e79fdad0760a653106f14f37
SHA256 bf467d3850990967fcff59c821f82489ca1ed0c0246b795bfab532e64c9362e5
MD5 15710b09fe672f077e2a4889686258a8
SHA1 706a0b4a44db01c4a1bb9038da32ff9a82b8f8bb
SHA512 926abcc8691d4ae68052d0fc4dad0eabbaa52026ed0b73e0f8147cc39f0a5df8022c7d69b1c295cf50ff3bc42520b3eb7ea236d094fd5ed948802b5d48101992
SSDEEP 6144:jK5nIK54IV2OyPlbh5nf+4a+9vkC7CYfHOn+Re8d1/w5KA81IJ8GpF6nuTmOOU:u3aIVCWAcC7CLn+TjYKkJj6GmZU
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13424

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaNextEachAry _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaCyMul __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 ord698 __vbaVarIndexStore __vbaNextEachVar __vbaFreeObjList ord516 __vbaStrErrVarCopy __vbaVarIndexLoadRef _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 __vbaCopyBytes __vbaStrCat ord660 __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj __vbaLenBstrB ord556 __vbaLenVar ord558 _adj_fdiv_m32 ord666 ord667 __vbaAryDestruct __vbaVarXor __vbaVarIndexLoadRefLock __vbaLateMemSt ord593 __vbaForEachCollObj __vbaExitProc ord594 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaBoolVar ord520 __vbaBoolVarNull __vbaRefVarAry __vbaVarTstLt _CIsin __vbaErase ord631 ord709 ord525 ord632 __vbaVarCmpGt __vbaVarZero __vbaNextEachCollObj __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaPutOwner3 __vbaAryConstruct2 __vbaVarTstEq __vbaDateR8 __vbaPutOwner4 ord560 __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt __vbaVarOr __vbaFpUI1 ord564 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaR8Cy __vbaRedim __vbaRecUniToAnsi __vbaUI1ErrVar EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface ord710 __vbaStr2Vec __vbaVarMul __vbaStrUI1 __vbaUI1I4 __vbaExceptHandler __vbaPrintFile ord712 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 ord531 __vbaFPException ord717 ord532 __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaGetOwner3 __vbaVarCat __vbaDateVar __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaNew2 __vbaInStr __vbaVar2Vec ord570 __vbaVarLateMemCallLdRf _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaVarSetObj __vbaStrCopy ord681 __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaForEachAry __vbaVarCmpEq __vbaLateMemCall __vbaAryLock __vbaVarAdd __vbaVarDup __vbaStrToAnsi ord612 __vbaFpI2 __vbaVarCopy __vbaVarLateMemCallLd __vbaFpI4 ord616 __vbaRecDestructAnsi __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove __vbaStrVarCopy __vbaForEachVar ord619 _allmul _CItan __vbaAryUnlock __vbaUI1Var _CIexp __vbaMidStmtBstr __vbaI4ErrVar ord580 __vbaFreeObj __vbaRecAssign __vbaFreeStr ord581

Sharing