08f794f4578f4cacb5502c6573504fe3f1bc0143586980196adeab2d3f9bdc64N

Sharing

Copy URL Twitter E-mail

General

Target

08f794f4578f4cacb5502c6573504fe3f1bc0143586980196adeab2d3f9bdc64N
Size

127KB
MD5

6449edb442ab75cd1cf44ca21d0cf410
SHA1

11cd86034b5c1579e2e5ae5ee7b682e01971dbc3
SHA256

08f794f4578f4cacb5502c6573504fe3f1bc0143586980196adeab2d3f9bdc64
SHA512

ef3f433d5b42b4f58f1808faac29a1999512f7df30ffae694b26f9d9f5561c2137f83e69493f44366909ad83250ba9bbc73e2029470f812c444245b0b6002c3e
SSDEEP

3072:Xfbzq980hAhm6MpD/1ngUoeyrVj3YyfbvYS4RIASg2gk:XfbOvQm6Mp5gppVzYS40P

Score

1^/10

Malware Config

Signatures

Files

08f794f4578f4cacb5502c6573504fe3f1bc0143586980196adeab2d3f9bdc64N
.dll windows:6 windows x86 arch:x86

9b7d050e207219e7012356964d919573

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:c1:88:80:ce:b5:61:19:64:5b:f6:7f
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

08/02/2024, 14:45

Not After

10/03/2027, 14:45

Subject

CN=IP Zinukhov Stanislav Igorevich,O=IP Zinukhov Stanislav Igorevich,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:43:4c:cc:7d:f4:98:8b:5a:d4:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

18/04/2024, 17:59

Not After

17/04/2025, 17:59

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1b:4b:72:71:13:35:44:db:28:f2:ab:08:40:87:c6:6d:88:23:2e:db:3f:c7:e5:9a:09:76:3d:0f:e1:53:cf:76
Signer

Actual PE Digest

1b:4b:72:71:13:35:44:db:28:f2:ab:08:40:87:c6:6d:88:23:2e:db:3f:c7:e5:9a:09:76:3d:0f:e1:53:cf:76

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\StartAllBack\StartIsBack11\Release\DarkMagicX86.pdb

Imports

api-ms-win-core-atoms-l1-1-0

AddAtomW
DeleteAtom
FindAtomW
GlobalFindAtomW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpW
lstrcmpA
lstrcmpiA
lstrcmpiW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
SizeofResource
LoadLibraryExW
GetModuleHandleA
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetProcessIdOfThread
OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
CreateThread
ResumeThread
GetCurrentThreadId
GetThreadId

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OpenEventW
WaitForSingleObjectEx
SleepEx
SetEvent
WaitForSingleObject
CreateEventW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-sidebyside-l1-1-0

GetCurrentActCtx
DeactivateActCtx
FindActCtxSectionStringW
ActivateActCtx

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegCloseKey

api-ms-win-core-memory-l1-1-0

VirtualProtect
CreateFileMappingW
MapViewOfFile
OpenFileMappingW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance

api-ms-win-core-psapi-l1-1-0

K32GetMappedFileNameW
QueryFullProcessImageNameW

api-ms-win-core-registry-l2-1-0

RegOpenKeyW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathAddBackslashW
PathAppendW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFileExistsW
PathRemoveBackslashW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l1-1-0

CreateDirectoryW
SetFilePointer
ReadFile
CreateFileW
FindClose
FindNextFileW
FindFirstFileW

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-mm-time-l1-1-0

timeBeginPeriod
timeGetTime
timeEndPeriod

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

user32

SystemParametersInfoA
EnableWindow
LoadImageA
SystemParametersInfoForDpi
FillRect
GetDpiForWindow
EndPaint
BeginPaint
WindowFromPoint
GetCursorPos
DrawEdge
GetWindow
GetDlgItem
IsImmersiveProcess
DeregisterShellHookWindow
DrawTextW
RegisterShellHookWindow
InternalGetWindowText
SetWindowCompositionAttribute
PtInRect
GetMenuItemRect
ord2557
LoadIconW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
IsWindowVisible
IsIconic
GetDpiForMonitorInternal
GetSystemMetrics
EqualRect
MapWindowPoints
GetWindowTextW
AnimateWindow
UpdateWindow
ShowWindow
GetThreadDpiAwarenessContext
GetWindowRect
SetWinEventHook
RegisterClassExW
GetClassInfoW
EnumChildWindows
UnhookWinEvent
SetWindowLongW
SetClassLongW
RegisterClassW
SetLayeredWindowAttributes
InvalidateRect
DefWindowProcW
GetUpdateRect
FindWindowW
IsWindow
GetParent
GetDesktopWindow
SendMessageW
SendMessageCallbackW
GetWindowThreadProcessId
SendNotifyMessageW
IsMenu
GetSystemMenu
SetTimer
RegisterWindowMessageW
GetClassWord
GetAncestor
GetPropW
GetSysColor
GetWindowLongW
GetClassLongW
MonitorFromWindow
GetMenuItemInfoW
GetMenuItemCount
InflateRect
GetCurrentInputMessageSource
PrintWindow
WindowFromDC
GetDC
ReleaseDC
DestroyIcon
GetSystemMetricsForDpi
DrawIconEx
SetMenuItemInfoW
GetMenu
GetDpiForSystem
CreateIconIndirect
GetCIMSSM
GetSubMenu
SystemParametersInfoW
GetWindowInfo
OffsetRect
GetGUIThreadInfo
SetPropW
DestroyWindow
CreateWindowExW
GetIconInfo
UpdateLayeredWindow
SetWindowPos
GetMessageExtraInfo
RemovePropW
GetMenuBarInfo
GetMenuInfo
PostMessageW
GetClientRect
SetMenuInfo
EnumThreadWindows
FindWindowExW
SetMessageExtraInfo
KillTimer

gdi32

GetStockObject
ExcludeClipRect
DeleteDC
StretchDIBits
GdiAlphaBlend
CreateCompatibleDC
GetObjectW
GetTextExtentExPointW
GetObjectType
DeleteObject
GetLayout
SelectObject
RestoreDC
SaveDC
CreateFontW
CreateFontIndirectW
GetBitmapBits
CreateBitmap
GdiFlush
GetBitmapDimensionEx
SetBitmapDimensionEx
SetBitmapBits
SetLayout
GetTextColor
SetTextColor
GdiDrawStream
CreateDPIScaledDIBSection
GetDCDpiScaleValue
SetBkMode
GetCurrentObject
SetBkColor
ExtTextOutW
GetDCBrushColor
BitBlt
StretchBlt
CreateDIBSection

kernel32

GetCurrentApplicationUserModelId
GetApplicationUserModelId

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
__stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_register_onexit_function
_initterm_e
_initterm
_cexit
_crt_atexit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

calloc
_callnewh
free
malloc

api-ms-win-crt-string-l1-1-0

memset
_wcsicmp
wcsncmp
wcsncpy_s
wcscpy_s
wcscat_s
_wcsnicmp

ntdll

RtlInitUnicodeString
NtResumeThread
RtlAdjustPrivilege
NtAlpcSendWaitReceivePort

api-ms-win-crt-private-l1-1-0

memcpy
__std_type_info_destroy_list
_CxxThrowException
wcschr
__std_exception_destroy
__std_exception_copy
_except_handler4_common
__CxxFrameHandler3

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-math-l1-1-0

_libm_sse2_acos_precise
_libm_sse2_cos_precise
_libm_sse2_sin_precise

Exports

Exports

InitDarkMagic
LoadRemote

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b7d050e207219e7012356964d919573

Code Sign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

20:c1:88:80:ce:b5:61:19:64:5b:f6:7fCertificate

Extended Key Usages

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:43:4c:cc:7d:f4:98:8b:5a:d4:00:00:00:00:00:43Certificate

Extended Key Usages

Key Usages

1b:4b:72:71:13:35:44:db:28:f2:ab:08:40:87:c6:6d:88:23:2e:db:3f:c7:e5:9a:09:76:3d:0f:e1:53:cf:76Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-mm-time-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

user32

gdi32

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-crt-private-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 74KB - Virtual size: 74KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 1024B - Virtual size: 2KB

.didat Size: 512B - Virtual size: 328B

.rsrc Size: 2KB - Virtual size: 1KB

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

20:c1:88:80:ce:b5:61:19:64:5b:f6:7f
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:43:4c:cc:7d:f4:98:8b:5a:d4:00:00:00:00:00:43
Certificate

1b:4b:72:71:13:35:44:db:28:f2:ab:08:40:87:c6:6d:88:23:2e:db:3f:c7:e5:9a:09:76:3d:0f:e1:53:cf:76
Signer

.text
Size: 74KB - Virtual size: 74KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 1024B - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 328B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB