blackguard | 2f16279e427a4195d134a8f4eaa2bbdb1187efa912e90947baa157097d89bdf6

Sharing

Copy URL

Twitter E-mail

General

Target

2f16279e427a4195d134a8f4eaa2bbdb1187efa912e90947baa157097d89bdf6
Size

17.9MB
MD5

a514c95f9620f1840d740ef4cb705e46
SHA1

61f35f337c2ada1f109766b5048b1c92edc52d79
SHA256

2f16279e427a4195d134a8f4eaa2bbdb1187efa912e90947baa157097d89bdf6
SHA512

548de80c34f31b3a5fa94c355813fd544cb67d46f0ab597d03a0a489393e7be64f61bddc95a667ada60c0b72800e10cbf82f379164033604cd8aaef7fe7714b4
SSDEEP

393216:8+BhUITbTGHn+viH3WgHivtW68+RTv07RPBMnkpxDLw:8MZ+nGkWgHicYwPBzM

Score

10^/10

pdf link agilenet blackguard

Malware Config

Signatures

Blackguard family
blackguard

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
static1/unpack001/KTR Bilgisayar Yönetimi/KTR Bilgisayar Yönetimi.exe	agile_net

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/KTR Bilgisayar Yönetimi/KTR Bilgisayar Yönetimi.exe

Files

2f16279e427a4195d134a8f4eaa2bbdb1187efa912e90947baa157097d89bdf6
.rar
KTR Bilgisayar Yönetimi/Bilgilendirme.txt
KTR Bilgisayar Yönetimi/Defender Hakkında.txt
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (1).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (10).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (2).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (3).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (4).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (5).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (6).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (7).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (8).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Hediye R10 Duvar Kağıdı - kalipsotr (9).jpeg
.jpg
KTR Bilgisayar Yönetimi/Hediye/Not.txt
KTR Bilgisayar Yönetimi/KTR Bilgisayar Yönetimi.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 874KB - Virtual size: 873KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.enigma1
Size: 10.5MB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
KTR Bilgisayar Yönetimi/Kullanım Kılavuzu.pdf
.pdf
KTR Bilgisayar Yönetimi/Teşekkür Ederiz.txt
KTR Bilgisayar Yönetimi/VirusTotal/VirusTotal.pdf
.pdf
- https://blog.virustotal.com/
- https://developers.virustotal.com/reference/overview
- https://developers.virustotal.com/v2.0/reference
- https://developers.virustotal.com/v3.0/reference
- https://docs.virustotal.com/docs/
- https://docs.virustotal.com/docs/api-scripts-and-client-libraries
- https://docs.virustotal.com/docs/browser-extensions
- https://docs.virustotal.com/docs/comments
- https://docs.virustotal.com/docs/community
- https://docs.virustotal.com/docs/contributors
- https://docs.virustotal.com/docs/desktop-apps
- https://docs.virustotal.com/docs/how-it-works
- https://docs.virustotal.com/docs/mobile-apps
- https://docs.virustotal.com/docs/privacy-policy
- https://docs.virustotal.com/docs/results-reports
- https://docs.virustotal.com/docs/searching
- https://docs.virustotal.com/docs/terms-of-service
- https://docs.virustotal.com/docs/tools-overview
- https://docs.virustotal.com/docs/whats-vthunting
- https://releases.virustotal.com/
- https://www.virustotal.com/getstarted/
- https://www.virustotal.com/gui/community-buzz
- https://www.virustotal.com/gui/contact-us
- https://www.virustotal.com/gui/contact-us/premium-services
- https://www.virustotal.com/gui/contact-us/technical-support
- https://www.virustotal.com/gui/file/80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf/behavior
- https://www.virustotal.com/gui/file/80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf/community
- https://www.virustotal.com/gui/file/80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf/details
- https://www.virustotal.com/gui/file/80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf/detection
- https://www.virustotal.com/gui/file/80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf/relations
- https://www.virustotal.com/gui/file/80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf/telemetry
- https://www.virustotal.com/gui/graph-overview
- https://www.virustotal.com/gui/home
- https://www.virustotal.com/gui/hunting-overview
- https://www.virustotal.com/gui/intelligence-overview
- https://www.virustotal.com/gui/join-us
- https://www.virustotal.com/gui/search/engines%253Atrojan
- https://www.virustotal.com/gui/search/engines:trojan
- https://www.virustotal.com/gui/search/entity%253Afile%2520tag%253Apeexe
- https://www.virustotal.com/gui/services-overview
- https://www.virustotal.com/gui/top-users
- https://www.virustotal.com/sign-in
- Show all
KTR Bilgisayar Yönetimi/VirusTotal/VirusTotal.txt
KTR Bilgisayar Yönetimi/Yazılım Tanıtımı/Yazılım Tanıtımı.mp4
KTR Bilgisayar Yönetimi/Yazılım Tanıtımı/Yazılım Tanıtımı.png
.png

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 874KB - Virtual size: 873KB

.rsrc Size: 168KB - Virtual size: 167KB

.reloc Size: 512B - Virtual size: 12B

.enigma1 Size: 10.5MB - Virtual size: 8KB

.enigma2 Size: 304KB - Virtual size: 304KB

.text
Size: 874KB - Virtual size: 873KB

.rsrc
Size: 168KB - Virtual size: 167KB

.reloc
Size: 512B - Virtual size: 12B

.enigma1
Size: 10.5MB - Virtual size: 8KB

.enigma2
Size: 304KB - Virtual size: 304KB