xiezi718805400
Behavioral task
behavioral1
Sample
3871406adc4c1dd16649734dc9f9e70567f1e714cd0f6f1751e0878ecf40b42d.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3871406adc4c1dd16649734dc9f9e70567f1e714cd0f6f1751e0878ecf40b42d.dll
Resource
win10v2004-20230220-en
General
-
Target
3871406adc4c1dd16649734dc9f9e70567f1e714cd0f6f1751e0878ecf40b42d
-
Size
3.0MB
-
MD5
436989add942930090eca6b3b2e0dafb
-
SHA1
ab19f1bac167b8a660044fb7f300718fde6cc2b0
-
SHA256
3871406adc4c1dd16649734dc9f9e70567f1e714cd0f6f1751e0878ecf40b42d
-
SHA512
91fd768e61956c7c6a2b79bf04eaeaa1fa8a3f6d7ad70c66115bd2ab61624b5764114587e2048259a97dce0821e183e26a42d7e91f073c020a5dac66bfd7124f
-
SSDEEP
49152:liHewsoD9PF7bE0f1dVAljZv6MUsCZTk/cWOPoy:IeW997bEU1dVApNNiTk/c
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon
Files
-
3871406adc4c1dd16649734dc9f9e70567f1e714cd0f6f1751e0878ecf40b42d.dll windows x86
2186e7e64c97682101759e65ace9c9c9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
lstrcpynA
FreeLibrary
GetModuleHandleA
ExitProcess
GetCurrentDirectoryA
GetProcessHeap
HeapAlloc
HeapReAlloc
CloseHandle
IsBadReadPtr
Sleep
GetCommandLineA
GetModuleFileNameA
DeleteCriticalSection
CreateThread
VirtualQueryEx
HeapFree
GetCurrentProcess
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
msvcrt
sprintf
strrchr
strchr
atoi
free
_ftol
floor
modf
oleaut32
VariantTimeToSystemTime
Exports
Exports
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 632B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ