Behavioral task
behavioral1
Sample
a664ea9901fff917f41e527b3634614306a5c14cc12b093e08d4ad482a221589.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a664ea9901fff917f41e527b3634614306a5c14cc12b093e08d4ad482a221589.dll
Resource
win10v2004-20241007-en
General
-
Target
a664ea9901fff917f41e527b3634614306a5c14cc12b093e08d4ad482a221589
-
Size
1.6MB
-
MD5
91232cb009403e6f508958f4e347269a
-
SHA1
a315319a9017c300b1454413fc3463247e8138c0
-
SHA256
a664ea9901fff917f41e527b3634614306a5c14cc12b093e08d4ad482a221589
-
SHA512
9ab5a6fc718f73135627dda7a09134c31ded9555bc9970e9ed08185f2e5bfe969a183fe46b85a1a9247b643d85fac5ee43be1f8f62a5768e15462c9297b884e1
-
SSDEEP
24576:/P848f8I8I8I8r8O8I8I8I8I8I8q8A8Bk:3848f8I8I8I8r8O8I8I8I8I8I8q8A8B
Malware Config
Signatures
-
Blackguard family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a664ea9901fff917f41e527b3634614306a5c14cc12b093e08d4ad482a221589
Files
-
a664ea9901fff917f41e527b3634614306a5c14cc12b093e08d4ad482a221589.dll windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ