Behavioral task
behavioral1
Sample
edda982bfd8986d01a3b5e005e5755ca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
edda982bfd8986d01a3b5e005e5755ca.exe
Resource
win10v2004-20231215-en
General
-
Target
edda982bfd8986d01a3b5e005e5755ca
-
Size
246KB
-
MD5
edda982bfd8986d01a3b5e005e5755ca
-
SHA1
68cbb8e9965fae9da6afba41dd600190755efe35
-
SHA256
10b86a89f56513268e5094837990648fec44b1ddf3f2f2c959dc23f6a4d8c630
-
SHA512
1309b7096e7e4733a036e4093ec28c9477ced09da85fffb838998a50354d9742b5cdef3b785ed1f74c107d51d0fc8d5e3b0160251cb14b54bd78aab696c91df1
-
SSDEEP
6144:vKSTkgWAlEC9R9+EWj2JH/OkNfKjbvWCeQWJ:zYgWAl7AjEfXKmCVWJ
Malware Config
Extracted
blackguard
https://api.telegram.org/bot1711224512:AAG22Nlr-jO4MyOqR-e8u_WyFQ4Bw7rDtVw/sendMessage?chat_id=1640241476
Signatures
-
Blackguard family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edda982bfd8986d01a3b5e005e5755ca
Files
-
edda982bfd8986d01a3b5e005e5755ca.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ