run
Behavioral task
behavioral1
Sample
0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00.dll
Resource
win7-20220812-en
General
-
Target
0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00
-
Size
80KB
-
MD5
91736a6edf7ba0ff3883de008c6dd1ee
-
SHA1
97d8a09de7272e7b8b74df5e402aa3620b7307e7
-
SHA256
0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00
-
SHA512
41bfa5f8d8dcedb6c63e0360ad5d4fcf8de23d38a7df037a325a7155d650cad3104acf691674d7b1eebaf9db34739c83463f9ec9df000390a763efdba6ed45f3
-
SSDEEP
768:TmvT5hPKXIm//39QqUCaNadrla2sI5ccdmGLkiGuWxZ:cH5m/P9xUCDdrY2s9QZ4xZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon
Files
-
0cf826c1d9c49f4348a2466120849e48c8092ba525493be51709ddd33762cd00.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Z�X0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Z�X1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Z�X2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE