run
Behavioral task
behavioral1
Sample
b98441121927000b9a14437de47fd30b93b367a7b241602fda195020a5c20667.dll
Resource
win7-20220812-en
General
-
Target
b98441121927000b9a14437de47fd30b93b367a7b241602fda195020a5c20667
-
Size
80KB
-
MD5
e7e93b82c2e51fc287ca6f25c4ded58a
-
SHA1
673240ccc31246fa0d53386f805037943e55558b
-
SHA256
b98441121927000b9a14437de47fd30b93b367a7b241602fda195020a5c20667
-
SHA512
6caf10dbdd63a6b6859c04d8ab66edd5acfde2d44222b2cfe5c66ea4f842e4e1c265cfdd0e56300bec0a86a43d946ca321b798a85ff7b952055bbdaa5b280416
-
SSDEEP
768:/doF/PjJaIm//39QqUHBNadrsa2edb9HmZELLsdbIWRWeFWxZ:wDm/P9xUH6drV2edb9G4iSxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon
Files
-
b98441121927000b9a14437de47fd30b93b367a7b241602fda195020a5c20667.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
�Q�0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�Q�1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�Q�2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE