blackguard | 00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc

Sharing

Copy URL Twitter E-mail

General

Target
00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc
Size 36.0MB
Sample240430-cc4ysahf2s
SHA256 00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc
MD5 f205864b3fd0679e60b2076f84890f86
SHA1 3cbcaf69c4a8ad3d1e8e2a94076ee93f5c7a08fb
SHA512 c0a045b7b1f79e5a6bfc1a9633f81a33f707f03ae7ae664652f06b23a9a0d1a6896b7837e60eb930b5f8cd33389fff5773f6097c8925c31bcb923a36ac4f1a25
SSDEEP 393216:inAqMInoJITfRwF6+YPlC6PIwt4jNQTXh7ywYzTcDxvVRzzWdtMPD9Z:in6iTfRwFOxostywY3cDxvVNyaPZZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackguard

Malware Config

Signatures

Blackguard family
blackguard

File Explorer

00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc

.exe 36.0MB

00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc

IMPHASH 5f7bf97ec922bad10bc4de737ab257ee
SHA256 00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc
MD5 f205864b3fd0679e60b2076f84890f86
SHA1 3cbcaf69c4a8ad3d1e8e2a94076ee93f5c7a08fb
SHA512 c0a045b7b1f79e5a6bfc1a9633f81a33f707f03ae7ae664652f06b23a9a0d1a6896b7837e60eb930b5f8cd33389fff5773f6097c8925c31bcb923a36ac4f1a25
SSDEEP 393216:inAqMInoJITfRwF6+YPlC6PIwt4jNQTXh7ywYzTcDxvVRzzWdtMPD9Z:in6iTfRwFOxostywY3cDxvVNyaPZZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

ff:d0:87:7a:e6:ae:ff:59:81:6f:0a:92:45:11:7a:e0:41:49:ed:8f:a5:b2:f1:68:b1:d9:9a:1d:22:f1:d9:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=202345323R,CN=HAKKO AI PTE. LTD.,O=HAKKO AI PTE. LTD.,STREET=120 ROBINSON ROAD\, #13-01,L=Singapore,ST=Singapore,C=SG,1.3.6.1.4.1.311.60.2.1.3=#13025347,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 28, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

1c:b1:2f:3a:20:06:a9:c3:fa:00:7c:c3

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 27, 2023 - Dec 27, 2024

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

67024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _invalid_parameter_noinfo_noreturn __p___argc __p___wargv _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _c_exit _configure_wide_argv _controlfp_s _set_app_type _register_onexit_function _register_thread_local_exe_atexit_callback _initialize_onexit_table abort _cexit _initialize_wide_environment terminate _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s setvbuf __stdio_common_vswprintf __acrt_iob_func fputwc __p__commode fputws __stdio_common_vsnwprintf_s _wfsopen fflush __stdio_common_vfwprintf

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

wcsnlen strcpy_s _wcsdup strcspn wcsncmp toupper

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-locale-l1-1-0

__pctype_func _unlock_locales _lock_locales ___lc_locale_name_func ___lc_codepage_func ___mb_cur_max_func _configthreadlocale setlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr frexp

api-ms-win-crt-time-l1-1-0

_gmtime64_s wcsftime _time64

Sharing

General

Malware Config

Signatures

File Explorer

00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic