blackmoon | Signed-语言包[.]7z

Sharing

Copy URL

Twitter E-mail

General

Target

Signed-语言包.7z
Size

86.2MB
MD5

456b29e1d430908e7c1427f39545ec33
SHA1

4a15ee78d1d522009586721d0889b1c842a96ecd
SHA256

6cc4412124674537ce946fe4266b4750efbbe237c3ed6f3e62287c5f33f3cdd1
SHA512

4d2614db80a495b38abcee5aca9b0758860abee5672405b683dd0bee29ec4508cb9ddb8b19690e5301f1e57a68e3ab9aa5d933a369dbdca7c8a79de2163692dd
SSDEEP

1572864:rB1ctpHw4qmIY85WznLGoPDAUAwf/G1NfjTWem8Ywi9MnA6ux/I9E:d1Sq4qa85MnLGobAUTf/C9KeV9i3x/IC

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/点击运行转换中文版3.exe	family_blackmoon

Files

Signed-语言包.7z
.7z

Password: infected
点击运行转换中文版3.exe
.exe windows x86

dd9ca5ff87de9eccb6254cd3bf7dee4a

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11-09-2018 09:26

Not After

11-09-2023 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:e9:f5:7d:ab:27:27:2b:8c:6d:4d:f4:4c:d6:75:80
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

06-06-2023 21:50

Not After

19-04-2025 21:50

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Dover,ST=Delaware,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24-06-2016 20:44

Not After

24-06-2031 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09-12-2022 18:30

Not After

06-12-2032 18:30

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11-09-2018 09:26

Not After

11-09-2023 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13-11-2019 18:50

Not After

12-11-2034 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:84:1a:21:81:3b:3e:1c:f2:2b:c2:f1:8a:a3:2e:f1:26:59:44:51:89:c4:2b:8f:ae:9e:1f:cb:13:67:b0:f8
Signer

Actual PE Digest

e4:84:1a:21:81:3b:3e:1c:f2:2b:c2:f1:8a:a3:2e:f1:26:59:44:51:89:c4:2b:8f:ae:9e:1f:cb:13:67:b0:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetTickCount
GetModuleHandleA
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
GetCommandLineA
RtlMoveMemory
VirtualFree
VirtualAlloc
lstrcpynA
MoveFileA
FindClose
CreateDirectoryA
IsBadCodePtr
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
WriteFile
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetFilePointer
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
FlushFileBuffers
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter

user32

GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
PeekMessageA

shlwapi

PathFileExistsA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 101.2MB - Virtual size: 101.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

dd9ca5ff87de9eccb6254cd3bf7dee4a

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

3f:e9:f5:7d:ab:27:27:2b:8c:6d:4d:f4:4c:d6:75:80Certificate

Extended Key Usages

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4bCertificate

Extended Key Usages

Key Usages

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

e4:84:1a:21:81:3b:3e:1c:f2:2b:c2:f1:8a:a3:2e:f1:26:59:44:51:89:c4:2b:8f:ae:9e:1f:cb:13:67:b0:f8Signer

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

shell32

Sections

.text Size: 68KB - Virtual size: 66KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 101.2MB - Virtual size: 101.3MB

.rsrc Size: 16KB - Virtual size: 12KB

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

3f:e9:f5:7d:ab:27:27:2b:8c:6d:4d:f4:4c:d6:75:80
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b
Certificate

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

e4:84:1a:21:81:3b:3e:1c:f2:2b:c2:f1:8a:a3:2e:f1:26:59:44:51:89:c4:2b:8f:ae:9e:1f:cb:13:67:b0:f8
Signer

.text
Size: 68KB - Virtual size: 66KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 101.2MB - Virtual size: 101.3MB

.rsrc
Size: 16KB - Virtual size: 12KB