ed3566c6cc3998deaaea01b5ea944345ff6c2725460dea5bd6249ed59bcd56dd | Triage

Sharing

Reason

config extraction: CfgExtr crashed: 'DarkGate' encoding alphabet is not 64-bytes long

General

Target

ed3566c6cc3998deaaea01b5ea944345ff6c2725460dea5bd6249ed59bcd56dd
Size

504KB
MD5

641e14bf8b8a13ebd0b5fe041b77a7ce
SHA1

3b125c0eb2b9a9b3bff16b7fb4b1f1759114ae19
SHA256

ed3566c6cc3998deaaea01b5ea944345ff6c2725460dea5bd6249ed59bcd56dd
SHA512

5ca1bf30a25fa61413cd717a38d2778ebd92feb41f497025050f9d58b4d18c1ece8adfa90af906aaa21996caef97152e7dbad619ed2a1f64f326373452a42f3e
SSDEEP

12288:B4i0blotKmmt1seWzTxbyUhHexOFQNk+kYuq8r1VdqZn0xu3/:Bv2onmt1xWzTxb9h+MFQa+R985VoZQuv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed3566c6cc3998deaaea01b5ea944345ff6c2725460dea5bd6249ed59bcd56dd

Files

ed3566c6cc3998deaaea01b5ea944345ff6c2725460dea5bd6249ed59bcd56dd
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 12B - Virtual size: 12B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ