Skype.pdb
Overview
overview
7Static
static
3AnyDesk (D...3).exe
windows7-x64
1AnyDesk (D...3).exe
windows10-2004-x64
1AnyDesk (D...1).exe
windows7-x64
1AnyDesk (D...1).exe
windows10-2004-x64
1AnyDesk (D...2).exe
windows7-x64
7AnyDesk (D...2).exe
windows10-2004-x64
7Skype (DUS...2).exe
windows7-x64
1Skype (DUS...2).exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk (DUSK V.4.1.3).exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
AnyDesk (DUSK V.4.1.3).exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
AnyDesk (DUSK V4.0.1).exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
AnyDesk (DUSK V4.0.1).exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
AnyDesk (DUSK V4.1.2).exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
AnyDesk (DUSK V4.1.2).exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Skype (DUSK V3.0.2).exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Skype (DUSK V3.0.2).exe
Resource
win10v2004-20240709-en
General
-
Target
Dusk.zip
-
Size
13.4MB
-
MD5
e5b433e6bd5a48d1c0e14ee9b97eb463
-
SHA1
3d9b41b08cd5500ac83d45fd1a03cb909f7febcc
-
SHA256
678143981ef5f825edd888d000ed10f31c54b3efe82e482fd289a022e82d5cc0
-
SHA512
19c08ff0ccbba262fab76e35c3593c9d6a481fcaee1edb65f850bbc384f683a434d7a96c34315eda77c61d036e5e70b541a8411ccdac47483e6583f0fb001827
-
SSDEEP
393216:u1lcrtUSzqwXlG0eqRNE+Pj2r6fxSm6sFDVUHUM4M:ccrtUslG0/XxP1fQm6sF3M
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack003/AnyDesk (DUSK V.4.1.3).exe unpack003/AnyDesk (DUSK V4.0.1).exe unpack003/AnyDesk (DUSK V4.1.2).exe unpack003/Skype (DUSK V3.0.2).exe
Files
-
Dusk.zip.zip
-
Dusk - Copia.zip.zip
-
Dusk - Copia - Copia.zip.zip
-
AnyDesk (DUSK V.4.1.3).exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
AnyDesk (DUSK V4.0.1).exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
AnyDesk (DUSK V4.1.2).exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Skype (DUSK V3.0.2).exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ