devrtl
Behavioral task
behavioral1
Sample
306a2f7f54e87f21797a520fe6411b2b200fa4117b9af1df61811b9960ce2582.dll
Resource
win7-20230220-en
General
-
Target
306a2f7f54e87f21797a520fe6411b2b200fa4117b9af1df61811b9960ce2582
-
Size
224KB
-
MD5
87ca1cd218f291dd1dae55a22df8e4b6
-
SHA1
b6aeebd337f59dc24378e997892b3403e4deb57b
-
SHA256
306a2f7f54e87f21797a520fe6411b2b200fa4117b9af1df61811b9960ce2582
-
SHA512
9c5c3b04d0c985ae10703dffa53e9a76b6440b0ab8bcc53f27965a0fd59dd4a0e08bbdf9e58fb272252e4ffdf1ccaa14d07f255410dd8331c42221e4af62c01d
-
SSDEEP
3072:DjkstWUSJC3x/10npK2VVO2Wj9ORpc0UHgtuK/hLout:DjkstWUSJC3tOng2jpRvoS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 306a2f7f54e87f21797a520fe6411b2b200fa4117b9af1df61811b9960ce2582
Files
-
306a2f7f54e87f21797a520fe6411b2b200fa4117b9af1df61811b9960ce2582.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
UPX0 Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE