devrtl
Behavioral task
behavioral1
Sample
5ff5e8e04a6614b0465ad7893c5cfee3a66cc150442b331a3d7d40b6117640e9.dll
Resource
win7-20230220-en
General
-
Target
5ff5e8e04a6614b0465ad7893c5cfee3a66cc150442b331a3d7d40b6117640e9
-
Size
224KB
-
MD5
ec440b6005f10d86055bee77759ca9ae
-
SHA1
dd084d3d2e1c69241b0331aa9786b4eaa41f2128
-
SHA256
5ff5e8e04a6614b0465ad7893c5cfee3a66cc150442b331a3d7d40b6117640e9
-
SHA512
907c7f09d1aac22b8032c3284550cdb7ea00809602719dfcce59252d85afb81c8fa6a819438e510096451f0142f3119632538d0bae665642a2f191cc64d6dc6e
-
SSDEEP
1536:y0RjLxJ6ayZ+BjfJCp7Mg0NSLfG6amTH/1eq2GjNhXxyr1b/U4gguBKgBnouy8:yIHSTMgISlaWEq2Gjnxyh/U4gguJout
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Processes:
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 5ff5e8e04a6614b0465ad7893c5cfee3a66cc150442b331a3d7d40b6117640e9
Files
-
5ff5e8e04a6614b0465ad7893c5cfee3a66cc150442b331a3d7d40b6117640e9.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
UPX0 Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE