gozi | BlackHatWorm[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BlackHatWorm.exe
Size

1.1MB
MD5

ff2d2c4638eabb42aea87ae084f65a6c
SHA1

7599c0c6ac507470ec8c85e9efa9f7bada802feb
SHA256

65c71566954fa20c2806222a6fdfaf4129f16954a89d9e50821aa2d27c41d89f
SHA512

b7864facd647afcbd436a80b3b60dc6b47137e96daa4d087fb0ec0ffc8e36e2c0305424f37cb5a2b3960cb38310b9403f79af83e68dadddb4f591a1389ed2ada
SSDEEP

6144:PbnV479d+YiP3Y3QvevhEtHvSFCW9fQNmn6lCPDA2h:Z4/+YiP3Y3QveuHvSFC5lC7A4

Score

10^/10

isfb gozi

Malware Config

Extracted

Family

gozi

Signatures

Gozi family
gozi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BlackHatWorm.exe

Files

BlackHatWorm.exe
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\happy\OneDrive\Desktop\Droppers\dual - Copy (6)\dual\obj\Release\dual.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ