Gridinsoft Logo
File Icon

Plg.dll Backdoor DarkKomet Analysis

Updated 1 year ago
Checked by Malware Check
plg.dll

Technical Analysis

File Name plg.dll
Scanner Version 1.0.137.174
Database Version 2023-09-10 01:17:41 UTC
⚠

Backdoor.Win32.DarkKomet.ns

Malware family: DarkKomet

DarkComet is a Remote Access Trojan that was misused for unauthorized system control and surveillance activities. Originally intended for legitimate purposes, it was discontinued in 2018 due to its role in surveillance operations during the Syrian conflict.
N/A
Detection Rate
40,960
File Size (bytes)
2023-09-10
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
80f3036110c00a57b09bba7343c16696
SHA1
aab69aa9dd1ae6c8ad38aca89720053c918d5560
SHA256
fc96e837e9902d3941210eeee94d79f9d268f9715fb966945bdb20cb93c9e497
SHA512
5e5140ec8a8b23d06ce3349e7c4b107c6a73fbe3fa55a05fa8178b3c3b76df6c417d3334a03824ac24c58208b03b46f94fa48f68cf313d93e214d40087b076e8
ImpHash
dae02f32a21e03ce65412f6e56942daa

PE Analysis

Basic Information

▼
Icon
Hash: 44739f32859fca438c6b5fddbd0ccb76
Fuzzy: 0fb4298ecb83b92fe58c067242126cd9
dHash: 00ca80c2c2808200
Image Base 0x00400000
Entry Point 0x0040ac9e
Compilation Time 2017-03-14 12:36:09
Checksum 0x00000000 (Actual: 0x00017511)
OS Version 4.0
PEiD Signatures No signatures detected
PDB Path G:\plg\obj\x86\Debug\plg.pdb
Digital Signature The PE file does not contain a certificate table.
Imports 1 libraries
mscoree
Exports 0 functions
Resources 4 Resources
Sections 4 Sections

Version Information

▼
Translation 0x0000 0x04b0
CompanyName Microsoft
FileDescription Extra
FileVersion 1.0.0.0
InternalName plg.dll
LegalCopyright Copyright © Microsoft 2013
OriginalFilename plg.dll
ProductName Extra
ProductVersion 1.0.0.0
Assembly Version 0.0.0.0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 36,004 bytes 36,352 bytes 5.74 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ C8203E67609587A1C5117A04B27E7E55
.sdata 0x0000c000 81 bytes 512 bytes 1.12 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BFA43156F5401B1280B962AB484D20D0
.rsrc 0x0000e000 2,080 bytes 2,560 bytes 2.85 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E785F54A5885AC84329AEBA3D999F496
.reloc 0x00010000 12 bytes 512 bytes 0.08 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 71DF85B31227764DAD4591DE89FD17C0

Resource Analysis

▼
Total Resources: 4 (1,794 bytes)
Resource Type Count Total Size Percentage
RT_ICON 2 1,040 bytes
58%
RT_GROUP_ICON 1 34 bytes
1.9%
RT_VERSION 1 720 bytes
40.1%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Backdoor.Win32.DarkKomet.ns Removal

Gridinsoft has the capability to identify and eliminate Backdoor.Win32.DarkKomet.ns without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware