darkcloud | 90804e65a82a6c3f246e0a6677b58d4241b0d8da92fda33639fae9a33c4ea28f[.]xz

General

Target
90804e65a82a6c3f246e0a6677b58d4241b0d8da92fda33639fae9a33c4ea28f.xz
Size 239KB
Sample241022-b3nttazake
SHA256 90804e65a82a6c3f246e0a6677b58d4241b0d8da92fda33639fae9a33c4ea28f
MD5 c58775da3dd13073389f0cdd4db11ca4
SHA1 3a7c97ff47fe57a82a5a5731cacfc101850c918a
SHA512 65c8988df6a24699ec22e11d32b737989ac0b4f476b836049474b12d78141680931de1a3ed144e2222dd450646511f40c4e00e9372111916ca52097bca8e17a3
SSDEEP 3072:0bXGYzSZmZyauvAj8VPWsytTAEUAg6mTn4lVHY1O/esn/P+ws0N4veatgzdLJ:kX7WYZy3vAoSt0wg6/3Y1O/eUHEeau1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud

Malware Config

Extracted

Family

darkcloud

Attributes

email_from
[email protected]
email_to
[email protected]

Signatures

Darkcloud family
darkcloud

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Receipt.exe

File Explorer

90804e65a82a6c3f246e0a6677b58d4241b0d8da92fda33639fae9a33c4ea28f.xz

.rar 239KB
Receipt.exe

.exe 452KB

90804e65a82a6c3f246e0a6677b58d4241b0d8da92fda33639fae9a33c4ea28f.xz

SHA256 90804e65a82a6c3f246e0a6677b58d4241b0d8da92fda33639fae9a33c4ea28f
MD5 c58775da3dd13073389f0cdd4db11ca4
SHA1 3a7c97ff47fe57a82a5a5731cacfc101850c918a
SHA512 65c8988df6a24699ec22e11d32b737989ac0b4f476b836049474b12d78141680931de1a3ed144e2222dd450646511f40c4e00e9372111916ca52097bca8e17a3
SSDEEP 3072:0bXGYzSZmZyauvAj8VPWsytTAEUAg6mTn4lVHY1O/esn/P+ws0N4veatgzdLJ:kX7WYZy3vAoSt0wg6/3Y1O/eUHEeau1
MD5 SHA1 SHA512 SSDEEP

Receipt.exe

IMPHASH ab942ef965a00d8ce4a98e4a647d3268
SHA256 b25969ec654bac567f82da096178825f2e7b89e03a9e4f7ac6ae2ae98aaa6b08
MD5 d4a26c141b32a5d61efbe2e7f69c0d00
SHA1 b66b6969264564861d5121a6a822b87de385ae91
SHA512 96dc77245fa41246c17f98fed9dd2b494b52c2d59e117aaff1446f4827d9114047cc33d5c04f4c38bad0958fc35db43287dd884ae24443b12e3eb616e80c63f9
SSDEEP 12288:rU0ZFgf1KgNxKBAwz05323yvMdb2U3jYKkJj6GmZU:rTZFQKiR23geb2UzYb6nZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15612

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaNextEachAry _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaCyMul __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 ord698 __vbaVarIndexStore __vbaNextEachVar __vbaFreeObjList ord516 __vbaStrErrVarCopy __vbaVarIndexLoadRef _adj_fprem1 __vbaRecAnsiToUni ord518 ord519 ord626 __vbaResume __vbaCopyBytes __vbaStrCat ord660 __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj __vbaLenBstrB ord556 __vbaLenVar ord558 _adj_fdiv_m32 __vbaAryVar ord666 ord667 __vbaAryDestruct __vbaVarXor __vbaVarIndexLoadRefLock __vbaLateMemSt ord593 __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord594 ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaBoolVar ord520 __vbaFpR8 __vbaRefVarAry __vbaVarTstLt __vbaBoolVarNull _CIsin ord709 __vbaErase ord631 ord525 __vbaVarCmpGt __vbaNextEachCollObj __vbaVarZero ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord527 __vbaGenerateBoundsError ord528 __vbaGet3 __vbaStrCmp ord529 __vbaPutOwner3 __vbaAryConstruct2 __vbaVarTstEq __vbaDateR8 __vbaPutOwner4 ord560 ord561 __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt __vbaVarOr __vbaFpUI1 ord564 __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaR8Cy __vbaRedim __vbaRecUniToAnsi __vbaUI1ErrVar EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface ord710 __vbaStr2Vec __vbaVarMul __vbaStrUI1 __vbaUI1I4 __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode __vbaExitEachAry ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord531 ord716 __vbaFPException ord717 ord532 __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaGetOwner3 __vbaVarCat __vbaDateVar __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaVar2Vec ord570 __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaVarSetObj __vbaStrCopy ord681 __vbaVarNot __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord578 ord685 ord100 ord579 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaForEachAry __vbaVarCmpEq __vbaAryLock __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi ord612 __vbaVarDup __vbaFpI2 __vbaVarCopy __vbaVarLateMemCallLd __vbaFpI4 ord616 __vbaVarSetObjAddref __vbaRecDestructAnsi ord617 __vbaLateMemCallLd _CIatan __vbaUI1Str __vbaCastObj ord618 __vbaAryCopy __vbaStrMove __vbaStrVarCopy ord619 __vbaForEachVar _allmul __vbaVarLateMemCallSt _CItan __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaI4ErrVar ord580 __vbaRecAssign __vbaFreeStr __vbaFreeObj ord581

Sharing