darktrack | notepad[.]exe | Triage

Sharing

General

Target

notepad.exe
Size

647KB
MD5

aac8edf78f4b9da09f83ba0b14e1177f
SHA1

a8533ee99f9c5fadb5856647836c18198f956adb
SHA256

45b33888ddb2748434643e4811f156f1fc2a5d339d3577945d8c9e9d88c5ff57
SHA512

59a3df44f3d88d8741e2e8ba3bf433ad152b5a41280108202e3d081c73836ac29ba3c8887f15f53ebe9bcb36519b7b33eb3ce6b6d021a6b0112879464d4c081c
SSDEEP

12288:NvR56z+QWEx9aoqV246/GBUv9ms3ro1czCT0g3FTi/Xc/JcN7MflOLq:wiQjxUBVC/GBUv9ms3ro1GqG/SJcq

Score

10^/10

darktrack

Malware Config

Signatures

DarkTrack payload 1 IoCs

resource	yara_rule
sample	family_darktrack

Darktrack family
darktrack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
notepad.exe

Files

notepad.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ