TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Static task
static1
Behavioral task
behavioral1
Sample
c52348c2950f7937876ea61ce7f2683388148197be3f54ee4d17aad888ba0128.exe
Resource
win10v2004-20230703-en
Target
c52348c2950f7937876ea61ce7f2683388148197be3f54ee4d17aad888ba0128
Size
6.1MB
MD5
216cdbf726ef092f751ae2ae8904f264
SHA1
22077a4775227dd49d3b9d7337178f7b8563ecb9
SHA256
c52348c2950f7937876ea61ce7f2683388148197be3f54ee4d17aad888ba0128
SHA512
4943cd01b553e590e2d0e150daf460ca5dcb5f3347aed83b14eb1d4492ba483b305fa7ce56fec34a90e9fe1e561d930f095cee15df67f4ea62a2e26b505263a8
SSDEEP
49152:GhJp7X6+vfwOyp6SqwS85N+S5dyelRkHo1XB7Ila3lxEJ6PLINVKC4JAQj5CyTZu:uXepOOdN+2dPRkHowla3lxE01j5z8
resource | yara_rule |
---|---|
sample | darkgate3 |
Checks for missing Authenticode signature.
resource |
---|
c52348c2950f7937876ea61ce7f2683388148197be3f54ee4d17aad888ba0128 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE