cvar
g_pCVar
Behavioral task
behavioral1
Sample
Darkstorm3.0/TF2Base.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Darkstorm3.0/TF2Base.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Darkstorm3.0/TF2Base.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Darkstorm3.0/TF2Base.exe
Resource
win10v2004-20231215-en
Target
28b02a8a271c212e54fa71a0cfebaea2
Size
276KB
MD5
28b02a8a271c212e54fa71a0cfebaea2
SHA1
400c1759ec04b32a967d30932d00f63c8af97e49
SHA256
ea8eba64567973b8e242da0f86843b71c4678bab9721b7851ed00196ee5820d1
SHA512
8d4d6e78349317ca26f85af08264f9755076d90c8e44e3f7dc4fc65ce0731ca4f4a52d9956bcaaa3c6f8c086c5433835d2a6d2d6d68494480f40a3d9ee1027da
SSDEEP
6144:pGqO6hjbICEZoAySed7rzp5Sf/aaczwFRLqNy2Ut2IHa9cC6ny:7O2bI6Syrp5sSXwrqNyzSco
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack001/Darkstorm3.0/TF2Base.dll | acprotect |
resource | yara_rule |
---|---|
static1/unpack001/Darkstorm3.0/TF2Base.dll | upx |
static1/unpack001/Darkstorm3.0/TF2Base.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/Darkstorm3.0/TF2Base.dll |
unpack002/out.upx |
unpack001/Darkstorm3.0/TF2Base.exe |
unpack003/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
cvar
g_pCVar
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ