ddn.zip
- SHA256 a2c5641802ebce37fe3b84d87c9a1b2acd3556054a0dc8ed72139728c148a64a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ddn/BDDarkSideDecryptor.exe
Resource
win11-20250313-en
windows11-21h2-x64
21 signatures
900 seconds
Behavioral task
behavioral2
Sample
acer.exe
Resource
win11-20250313-en
windows11-21h2-x64
14 signatures
900 seconds
General
- Target ddn.zip
- Size 9.6MB
- Sample250408-e29axaxydt
- SHA256 a2c5641802ebce37fe3b84d87c9a1b2acd3556054a0dc8ed72139728c148a64a
- MD5 6f2982e7ffac0d62f23d367b117ca8d1
- SHA1 c20282f94d7d1fa8749555fa6242a0dba67b2095
- SHA512 e7caf61a62cd4329b8f0c70bf1571ac8cd61b9db1fcff4fdd4537f00693ff1b43bd20fd8d52f55fb5c45aa0cb83eb5b4dbad89740262ae20b6bd3dba3d08b9da
- SSDEEP 196608:7EQcdOJkjbGw1+mIw6cpf3QLlojLd6bU9dSKF6HUgqvs:7EQcdz7+mI7iQLliy0sk6HUgqU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack003/acer.exe unpack004/151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe unpack005/156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll unpack006/8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File Explorer
-
ddn.zip.zip 9.6MB
-
ddn/BDDarkSideDecryptor.exe.exe 9.5MB
-
ddn/darkside-main.zip.zip 129KB
-
darkside-main/.DS_Store6KB
-
darkside-main/0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9.zip.zip 32KB
-
acer.exe.exe 56KB
-
darkside-main/151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.zip.zip 31KB
-
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe.exe 59KB
-
darkside-main/156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.zip.zip 32KB
-
156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll.dll 54KB
-
darkside-main/8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.zip.zip 31KB
-
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe.exe 59KB
-
darkside-main/README.md2KB
ddn/BDDarkSideDecryptor.exe
- IMPHASH c0bf34e100d570b80b7dce11087a79bc
- SHA256 1a72fe563f588580440da34a03b1af3ba072e66404608c521b4adbcb034a33f6
- MD5 cb1b67988c63e6e951be00b3eda7f74f
- SHA1 049fff52f877516a756c6333d12b3c1c1cfbe519
- SHA512 ef1d74da565026fef631f83dee70fafb661bea74cad69b70035f10700b733f64ce34b3308c0fee59222d1eb0767b87672f1f824ea923008c70a3e8be229ff289
- SSDEEP 196608:IdJEHHWtwPlARRmtejsum3/DBekLV58IzN6+ZR62Wi:IbEn9PlAGMivDdjxNF762W
- MD5 SHA1 SHA512 SSDEEP
Digest
cd:bd:51:bd:ab:c8:87:61:03:a9:f4:b5:11:b5:7f:07:08:db:e8:c0:8a:27:f7:a3:f7:bb:01:fe:43:87:c8:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO
Chains
Apr 27, 2021
CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
8e:ca:fa:1e:f9:a5:f7:c8:62:df:9d:1e:6b:03:46:27:a7:f5:5a:5e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO
Chains
Apr 27, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO
Serial Number
0d:32:b8:a4:68:df:3b:34:c0:09:a7:74:9a:68:29:f0
Issuer
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 27, 2020 - Dec 5, 2023
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO
Serial Number
0b:02:a4:0e:13:21:fb:40:cc:eb:94:78:22:46:bc:8d
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 14, 2020 - Dec 5, 2023
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
6
Entry point
17469
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateDirectoryW
GetCommandLineW
WriteFile
GetTempPathW
CreateFileW
CloseHandle
GetNativeSystemInfo
LoadResource
FindResourceW
CreateProcessW
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
user32
wsprintfW
MessageBoxW
shell32
SHFileOperationW
vcruntime140
wcschr
__std_exception_destroy
memset
__current_exception
memcpy
_CxxThrowException
__std_exception_copy
_except_handler4_common
__current_exception_context
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_initterm
_c_exit
terminate
_cexit
_initterm_e
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
__p___argv
__p___argc
_controlfp_s
_exit
exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9.5MB
Virtual Size
9.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=29804,
count=26, id=261, version=29804,
count=12, id=260, version=29804,
count=2, id=259, version=29804,
count=7, id=257, version=26715,
count=66, id=1, productName=Unmarked objects,
count=7, id=260, productName=VS2019 v16.8.2 build 29334, version=29334,
count=1, id=265, version=29912,
count=1, id=255, version=29912,
count=1, id=151,
count=1, id=258, version=29912,
ddn/darkside-main.zip
- SHA256 8f89ead036fde496467f1ce100b27948d5a72aa316f645dcc79d5cfc739164b6
- MD5 ede38b854967e345b5098a682fe34543
- SHA1 49979a7dc343d6b9a4446f9b62b622d8b4cfef74
- SHA512 a634b119741f80e9da1e2e5c659546a566e3a7f55e92c8521d747011c841672568eeeb852aee6f647a2534c05049dc03c15083f3a51520cebb5a064ba85afee4
- SSDEEP 3072:xOBsdXL4Xo42LtWEcAXJSFc0nUxu5Erik0aW9MaG8xEQOnx:xOC5IMNP590euzFPG8xEQ+
- MD5 SHA1 SHA512 SSDEEP
darkside-main/.DS_Store
- SHA256 9e389cce5ae5379ffbfd413286fbc39d43b2bdb1d12767458c4b633ec4dae9f2
- MD5 34431c269e9f69dd02c6f84fc4287404
- SHA1 a2c43d41947fb43939a48abd041d70bae386425e
- SHA512 347438e71372d6e1242765b2b48489006b7a8008920d391cee7f5b45e50e5072c07682017530ccc3e6f39c53874d3c4a0c63ce9a8a15b05f86b320e6775bc482
- SSDEEP 12:QiwPH8zY8TYZK9EEX/HnXw6XAERqXw6X:fjtrfnVMV
- MD5 SHA1 SHA512 SSDEEP
darkside-main/0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9.zip
- SHA256 23244f1a10efd5c452432abce1e998c09b8bb5b56afbade932f24c59e9d5bf04
- MD5 36f7a0ba7055ad89a76cccb1019ce2d9
- SHA1 4e86f8e7a47535a3f417ab9acaea553e0425b950
- SHA512 d2c35c6d2fc45d177275a2653666c8fa4af2e6d6d52469649e38b5ba07d08599ac9acafdde3cb254b34a749dc32f88ad33eb0de776f9e0236820436f4cdcb020
- SSDEEP 768:xo6dP0Q0OaPB6jPKedXGUTyD2UfBX6MQTECyRI4PIo:xzJOBkdXLTEXNTm4H
- MD5 SHA1 SHA512 SSDEEP
Password
infected
acer.exe
- IMPHASH d7eea11ae47ec0d735ecd47e54de8af5
- SHA256 0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
- MD5 979692cd7fc638beea6e9d68c752f360
- SHA1 c511ae4d80aaa281c610190aa13630de61ca714c
- SHA512 d7b7b6a968e6d7b7f3e7f98decb6b331b08122e491bf0b0dbe243223fb177218a758c34830f20c47f2a799acdd146297ec7f930c2bb4d5c6830ce65c8274ea6d
- SSDEEP 768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLd9kvAx0:g4HHerjZX7pLjJKjSO5i
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
45757
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
ntdll
NtWriteVirtualMemory
NtReadVirtualMemory
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text1
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
darkside-main/151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.zip
- SHA256 65973ba1a7483de1f4f9b69458e820de950cea7dd8253f5a9adebbee6447c367
- MD5 b57c47e3adb9b581585d2ee838ad8212
- SHA1 77a57121d2598228ff508a2e720eaf4117d2a654
- SHA512 fa184c29c976224636d03a1f8e41762b7a69499c152ac1af0933f9d00947b048a5c09f302cad1add8e5a32e2d7f5f8318ec63488dc3345313f9de751972aa0bd
- SSDEEP 768:OGVKR4VqiuVjTjaA9Tt//aYhvdff5vgS4ikJQ4A2ON:hLtuB/B/PdX5vv5LfHN
- MD5 SHA1 SHA512 SSDEEP
Password
infected
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe
- IMPHASH 17a4bd9c95f2898add97f309fc6f9bcd
- SHA256 151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5
- MD5 9d418ecc0f3bf45029263b0944236884
- SHA1 eeb28144f39b275ee1ec008859e80f215710dc57
- SHA512 82ced42a32f18ede4358459e08bed1adff85d49c952aca7a086571c5b71fd8b3185ea4306abd1f4e639a12f11161f43c73bf6049d76902d365c5a5e4c7e71f3d
- SSDEEP 768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvD7Y23W58:0x7Fu4/ihrhDTV1ylbcZ58
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33205
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryA
ExitProcess
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
374B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
darkside-main/156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.zip
- SHA256 c02026fa1c485d96350e2a53b6306abd6cdfd93e28bdcf47c8419586372c2046
- MD5 347234a33741bd0331725a3cd5f10f5f
- SHA1 973b6f38e632f0ae85b7f15f551a702fe12fab5e
- SHA512 00fcac559d732261d1bcad433a707d2bfbd58ab8783a84caa1a501e0b8254763d4585444086b4135540609afa22d9456462adc936bad04839bfaa01f387f1bf1
- SSDEEP 768:YU+o2vJ6L0nAjxoYOP+3j6bwy5paK/k1Xn/+Z4U:Y7vY0nUx/dY5E0kl/iJ
- MD5 SHA1 SHA512 SSDEEP
Password
infected
156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll
- IMPHASH 6c8408bb5d7d5a5b75b9314f94e68763
- SHA256 156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673
- MD5 f587adbd83ff3f4d2985453cd45c7ab1
- SHA1 2715340f82426f840cf7e460f53a36fc3aad52aa
- SHA512 37acf3c7a0b52421b4b33b14e5707497cfc52e57322ad9ffac87d0551220afc202d4c0987460d295077b9ee681fac2021bbfdebdc52c829b5f998ce7ac2d1efe
- SSDEEP 768:u2v9Ij6f3J8OT1PMK30DbQDH2doyomHRL83M4/NShWxEs0l29SFd2Xyj09rLd:fmET1PMK3qbpHY3M4wWmXgSFTSrLd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
45752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text1
Size
1024B
Virtual Size
795B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
446B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
darkside-main/8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.zip
- SHA256 9afd3a27d61810af2bd40b20663c0ca72d95741f2960b793141b23c3af1afa82
- MD5 66c83a95825bcb4c79a320fc0f5ffa60
- SHA1 32e3a44dc248b08700bfa345548e4b2315bc51f8
- SHA512 412368f78f52f21c71f233e9f18093a70d952b6daa542aa3bf7b4300fd7b6e7e349fb7c65b56573e9652203ba109c4bb7f0d3f8db524a0b3304e45eb1333425d
- SSDEEP 768:Bt9SjOwAbQVC1M1usyOdvd2ZPdwolvxAGqg4FQG0MKTOYiiOG:BPSjOws9M10Gd2XxWGDj0G
- MD5 SHA1 SHA512 SSDEEP
Password
infected
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
- IMPHASH 17a4bd9c95f2898add97f309fc6f9bcd
- SHA256 8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc
- MD5 04fde4340cc79cd9e61340d4c1e8ddfb
- SHA1 88fc623483f7ffe57f986ed10789e6723083fcd8
- SHA512 105ddfb8bbfedc8460fb1e6d26c6cd02ea81bfdc12a196c1c2f8e52bc73faf03a688339b4c231ab5b5b3885f2ad248115c32c95fc64e84462a16c3e237e6fc9c
- SSDEEP 768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1yldoZrY23W5o:BpDtG4nMpboDTV1ylVZ5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33297
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryA
ExitProcess
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
374B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
darkside-main/README.md
- SHA256 d06f6534d40d6ceeffbe3ca4697f5c1fc98799165b8335ce6a2e591a3c5f5a4c
- MD5 adb4ea960063378678c85b28367f2abc
- SHA1 3644366c6ad57514b7af43f1c4e47ae89eb71806
- SHA512 f30dbe440e72ba0b4626b030f360ff41618881e61061513fe838203c9596787e6ed03eb8e5ece57e86518fd8102e1617a9c5cef60d7d2e593a6b7acd641b1470
- MD5 SHA1 SHA512