Dark Spy[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Dark Spy.exe
Size

732KB
MD5

7ba9ddfe79e3a7e23b8ce520a8fb96d8
SHA1

37ffc9b034adca68ddab2d29643e33c7be8e4f43
SHA256

93501378f8924d04782b5d18890c2e14fbcbfc384f48d883e29a8483bddac803
SHA512

48b1e7c5f7ec151952e90c0dd2cbaef469eeb828cb0484725ebdf22ba58c06c9d0b1c04d44ad82261f7e0e30a0c82429e53d03c84a0fe2e91fc9fa36927098d0
SSDEEP

12288:mgYpzDUM/BTA0yFpvp0H3QUlVSr1nnDHkYcnNV6Vk1Sc6Z:mgIUMpTA0yFpx0HEr1nnDHk7V6VF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Dark Spy.exe

Files

Dark Spy.exe
.exe windows:5 windows x86 arch:x86

b77b99c3883f50fc5eeab54139139034

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetStockObject
DeleteObject
SetBkMode
SetTextColor
CreateFontIndirectA
SelectObject
GetObjectA

user32

GetDlgItemTextA
wsprintfA
MessageBoxA
LoadCursorA
GetClassInfoA
CheckDlgButton
SetWindowLongA
CallWindowProcA
GetActiveWindow

kernel32

WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
VirtualProtect
VirtualAlloc
LoadLibraryA
GetProcAddress
lstrlenW
CreateThread
Sleep
WaitForSingleObject
FreeConsole
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
HeapReAlloc
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
DecodePointer

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Bzj4A
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 632KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b77b99c3883f50fc5eeab54139139034

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Sections

.text Size: 71KB - Virtual size: 70KB

.Bzj4A Size: 8KB - Virtual size: 8KB

.rdata Size: 632KB - Virtual size: 632KB

.data Size: 13KB - Virtual size: 15KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 71KB - Virtual size: 70KB

.Bzj4A
Size: 8KB - Virtual size: 8KB

.rdata
Size: 632KB - Virtual size: 632KB

.data
Size: 13KB - Virtual size: 15KB

.reloc
Size: 5KB - Virtual size: 5KB