_�����ӳ���
Behavioral task
behavioral1
Sample
7ca0d3f5fb8f33c2ad8b91dbcf249a3acf67c9e03bffec322a9cccd81298daae.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7ca0d3f5fb8f33c2ad8b91dbcf249a3acf67c9e03bffec322a9cccd81298daae.dll
Resource
win10v2004-20220812-en
General
-
Target
7ca0d3f5fb8f33c2ad8b91dbcf249a3acf67c9e03bffec322a9cccd81298daae
-
Size
820KB
-
MD5
090128272daef9e1780fb59393162da0
-
SHA1
11f6d7d9376109bbfc746557bd5c679e59ca2dda
-
SHA256
7ca0d3f5fb8f33c2ad8b91dbcf249a3acf67c9e03bffec322a9cccd81298daae
-
SHA512
b3a389e79edfaf8b33e49f0034c08ff65ee79f28276e2ba4e146b79d690cf7b2d7ab90d4bf8f0eaae6ba45bb58f21f0bf9f8f72e758c2988f9b09df18a8506ac
-
SSDEEP
24576:x9FGffTo5fmshP5JCsJANLzBUyayNwSJUtbTpp:x96fKmshDfGyvFp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon
Files
-
7ca0d3f5fb8f33c2ad8b91dbcf249a3acf67c9e03bffec322a9cccd81298daae.dll windows x86
b0aec311b2a9bd5e250713c7b38586eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Beep
VirtualQuery
GetModuleFileNameA
WaitForSingleObject
GetExitCodeThread
VirtualAllocEx
VirtualFreeEx
FreeLibrary
GetSystemDirectoryA
TerminateProcess
CreateProcessA
CreateWaitableTimerA
SetWaitableTimer
VirtualQueryEx
VirtualProtectEx
CreateFileMappingA
UnmapViewOfFile
ReadProcessMemory
CreateRemoteThread
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
LCMapStringA
WriteFile
CreateFileA
GetTickCount
Sleep
GetCurrentThread
FindFirstFileA
FindClose
GetVersionExA
GetCommandLineA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
SetFilePointer
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
RaiseException
VirtualAlloc
CreateThread
WriteProcessMemory
OpenProcess
GetCurrentProcess
lstrcpyn
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenFileMappingA
CloseHandle
RtlMoveMemory
MapViewOfFile
FindNextFileA
GetTempPathA
GetWindowsDirectoryA
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
user32
MsgWaitForMultipleObjects
GetGUIThreadInfo
GetWindowThreadProcessId
PostMessageA
KillTimer
ShowWindow
IsWindowVisible
FindWindowExA
SetWindowPos
GetClientRect
GetForegroundWindow
GetClassNameA
wvsprintfA
GetWindowTextLengthA
EnumWindows
SetTimer
CallWindowProcA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindowTextA
advapi32
AdjustTokenPrivileges
CryptCreateHash
CryptReleaseContext
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 684KB - Virtual size: 760KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ