Behavioral task
behavioral1
Sample
c64cce947e5aae2cd37b6bb8f41a6eb7dab31b270721f18069f4db36e30326f1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c64cce947e5aae2cd37b6bb8f41a6eb7dab31b270721f18069f4db36e30326f1.exe
Resource
win10v2004-20231215-en
General
-
Target
c64cce947e5aae2cd37b6bb8f41a6eb7dab31b270721f18069f4db36e30326f1
-
Size
3.0MB
-
MD5
cd205f18c5f89d990125b15735cc2b64
-
SHA1
42c620ca3dc0b07632e6c99ff36a0cd5fffa70b3
-
SHA256
c64cce947e5aae2cd37b6bb8f41a6eb7dab31b270721f18069f4db36e30326f1
-
SHA512
0b5993187d6d638ea1bab81256e51b15c0ea71668fc4bc973d86d998068ef2dbba86b6147c7f2b21162c413fa32842242cae0b43adb8d2ad80752282dbadfe82
-
SSDEEP
24576:/tkExRV2eD6jC5pjUg3HUg3/Ug3HUg3yUg3NnHn/g/CUg3HUg3hV1qn90mwUaQJa:/tkEl2eD6jC5pq/mES9NwhQJmaxZG
Malware Config
Signatures
-
Blackguard family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c64cce947e5aae2cd37b6bb8f41a6eb7dab31b270721f18069f4db36e30326f1
Files
-
c64cce947e5aae2cd37b6bb8f41a6eb7dab31b270721f18069f4db36e30326f1.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9.9MB - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 262KB - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ