Darkside Bahaa[.]zip | Triage

Sharing

General

Target

Darkside Bahaa.zip
Size

33KB
MD5

7616c32b9c1bac6ca93d2dabaebb7747
SHA1

1553584c8e201ee3d04ad376408585c7c271a018
SHA256

653e076b154b3a70afba1234d3cde5479af8317fbcc4a92f2887f264ac29e690
SHA512

b9dd78644ac560b76d42b5e3d88ea82602f96f626c14fb38ca3174a7e58621e06b90cb159218d96e196d7676788ba71bab9df78d42ef93e127b9c0382272c424
SSDEEP

768:7NvUEvpTWN0yUbFGGyi4HAsK5EKSIQosDyh2bZVUt3WqRgc7M0yTpQb:vxTWN0yidt5OIFsGgXUt3W+1I0cQb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Files

Darkside Bahaa.zip
.zip

Password: infected
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
.exe windows:5 windows x86 arch:x86

d7eea11ae47ec0d735ecd47e54de8af5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess

ntdll

NtWriteVirtualMemory
NtReadVirtualMemory

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE