�x@-���VP��$��ͮ��n%oq�"�j�#w����Z��3#���� ?�zo�#���TH�>.�G���L4�Ma&���-a���ń�(9;�?<�0�~e4q��F���B������k��8��rq�Q�*�ոv"+�EY��2[�dB_��ƣTh?��4���d '4�kРF59��i���+R���aJ`�|f!f��F�`���S*��S��6�^ZZ��+����w=�'Wj�L�dda�p����IJ�mVrS���=0�Z����� M����ԟ���1U����:x�Q�p��5t�����̺�A�����l��f��]����:�/�X�>���m�zg=���4�k�+@ڄ�k�ˡ��� ���:��?�]^-"q�J/�r곖"D$�b>�h�Pb�Ξz��Fj���d����֪��!)�E>�o���[Y��#�5�B�J�)]���3�5O]^�D��~���V���WKW�/|C>'��[��� ��_e�_1��3Ҝ��fS�<9q��X���J6V6�n�{PALc�ܫ��1��`gkC�.�s�g��u1���r4��G|�i��"D�H� )�)(Iˈ���7���B>�Pf�V<-s�u �X�V���$�țqk��`J�"w�.1}Z?������E.�wP�)�WOam�y�g7������@�F�%��� ���������s�1$u��VQ�`Y���#S��z��*i�����@&ڴ&����P"��S܀�ZPc�O��-2��:P�UaMT��1:�`��!^��}7���xԒ�ؔ��o{�,�&g�h�r� ��S5�`�X}��^?>c{U��@Jp}�_3��W ��:�<���v����OI���0Nr9 �k`Y�jE%è�!�������]��|�ԭ(��Z�K����NȘn�g�&��6��m�K���"h�g1��F�/l��/��:vd�Ĉ#���N���j-^Y��N�ʇ��o�y�`/č˂����p>V�_dƌ`�b�"��/�����Oe�=��T%�%�>�(.ו���J4+�O�Ӧh.A6�8q� ��w����`C�_�'������ ��cY��̛�w ��.1^�`�_�-�^�t�6�/�3�e��[����n��֙^��Y�4����T 7����!0��d�Z��Aw���3��R$�$w/j��@��%M�sMYzI�:� ��7��/���F���tKܱ�`L�V���:��ij��C �tw���ӧ������[�����Gy7���9�H������{�Z"�:S!�������ύ?C^T꿪��ę` ��4>|>�{������h�ya����D�Y;�0z�7B�� ���Q��Z��p��,�.��n[�]6�L�bG5�/��o�q^�dړrX� ?��7�UܘӋ�4�K�7aWA��y%Mp���������J�[.��4m�8�=Eti����q�ԼXju �U}�0����1�q�5�qK��D4�p��h�O� �{N��X��_��'qh<�*�p,���V�Q���=����ŀ����ļ��4�T6}�纄�"�g�]���ؕl�0���:�Z���h#����黚O��{}��=��V|�ORtEm� �>�8�%X��%ӖC����иG�y�*�B#�*j�E�Fu��.�~W��v4�B��_X#�>�����ܘ�8�f�6f6�j��[{�wsS��,�2���~#�'��9��Zr����]�$�q�c��ֺ�}_�r6�x̴i�Nu� ���&� ��7�/��u���E���p5�7&�l�@�7�F�1�E��w��"�N�/����v ���3�g�a!`�2A�Th+���/my��)|����?$h�`#��ߦ,�8TeX�ٟ�C��Bܘ�/�Q�{;�b���[Z�P����3��貺m��F�x�{o{c��<�]�n�/]��|˛˹�z��my�沼֑R�0��6��xT���,�p���J)8ە��=�Tcj�:���I[�E���a���VOa?(�FP�;2#��x�s/_�����*Ȼ-�EPLo6���S�{�ͳ+��V�\�d����;w����2�{>�x ����v�F��j �ƈb�w��no^�j,c�q䝌,��iv�O&��ͽ(i��vD�-���M~sό]��5xm�|�����Vk��.��i��Zn=�@����ڡ��%]�����_�WR��">mB���!�%Ә��ꀵg���d�c"5'k;�#������7��@���,�#r5yVU�K��4��:���U/:W�4����Q�b�H��s'e�:'� �%蟥���/�x���Z������Ġ ���I;u~/�k���jp���&��N�� ��B�h������:x(Ţ�{>Ӻ�/�4J������0'���*q�(-�{��T�'`A��Ό��]s�Zo]�o���+K��P�d�j��H�{�a.�WU/?7�; b�i��-YA��\�N*��5b�2L�7<LbPm����cx��xm���hvOe\8,y��s͂Ez�c�O�� ��e:�Qu�X��7w��L�� ����:�ps�7�������s �����,�):C�l�̐`H��'���T���v�[����V�\=<��5�����B�*�$��Ny%At��8g~��<��;�>��+��I��r�dQ-o�f$0z���[T���E�- ْ������4/��?�Bnm 90[��%���%S�x7U���^�����Q �L Ѣ��0��(�W=�Eb��-�L2Ղ���By�� �¥۹��KZE�g�Hb�_��o�q�N���g1]V�O��q ���J����bEc�U���N�����SJ�}��'����s�Â;���iL��c�b��W��*0�f� W���c�4�e��,u��v�&�k{!�G��[�QG�OB)�}f��ס� $UG�jv�)�|LG���-�e��:�î5�����U�VUL�' D� ��\1�W�W�7��j�'�Dr���� ���|(�Mf���=ģ�'T{J}ޯ��y~G�/�-�Wղ�}�
Behavioral task
behavioral1
Sample
BlackLegend Public/BlackLegend Public.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BlackLegend Public/BlackLegend Public.dll
Resource
win10v2004-20220901-en
General
-
Target
421a92d155959ae6652724131ad2ba71be24803c33a8b863e09da59d7fae7c5d
-
Size
216KB
-
MD5
2b7ec9b3b776c25f71e679640a9ba988
-
SHA1
29a14de9462b3d155441b1c0b8bd46ac49cde9f1
-
SHA256
421a92d155959ae6652724131ad2ba71be24803c33a8b863e09da59d7fae7c5d
-
SHA512
403238f497f9ed3578a083ad52c74714791ed6b9b7dbefa95dd4439d5b222310a754b4985d0d16b6879f2559952bca801716e2b5f5dac6c6888845f4d1286867
-
SSDEEP
6144:HGMJtOyaBl2aKjBrWZjBVpS7k594q7bvt0n5:mMJoNoa4BMp97a
Malware Config
Signatures
-
resource yara_rule static1/unpack001/BlackLegend Public/BlackLegend Public.dll vmprotect
Files
-
421a92d155959ae6652724131ad2ba71be24803c33a8b863e09da59d7fae7c5d.rar
-
BlackLegend Public/BlackLegend Public.dll.dll windows x86
1ed643a8ee6e09f0dfbfccb8260ede7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
msvcr90
_encoded_null
gdi32
DeleteObject
advapi32
RegOpenKeyA
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ