b_Get
dllstart
����_ZwQueryVirtualMemory
����_ZwReadVirtualMemory
����_ȡʮ�������ı�
����_ȡ�ı�����
����_ʮ�������ı���������
����_ʮ�������ı����ֽڼ�
����_����2
����_�ر�
General
-
Target
334e79c968449a9ef5bb99de5379b43650f9da703eebe72c9e797d487b3d6dbbdll_JC.dll
-
Size
148KB
-
MD5
71ebcd544120ce467d5893ea2ca547d1
-
SHA1
dffbec23ca5e2fb78310fb27661177f8034e5b15
-
SHA256
334e79c968449a9ef5bb99de5379b43650f9da703eebe72c9e797d487b3d6dbb
-
SHA512
da362de875a203caa1d14f279de63a49c4ce1244fa00014647b23b691c4b6000416bfa38980115ad2e003a584efbcc345ff6dbab418e138a6672685c1e60ff64
-
SSDEEP
3072:ref9rpDNfhU6n+ENWrfkaPTMW4k4TwnOSVyMxmHqqyoQAi4:izJhT+ENEfkETMeOwOSUMxmQo64
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Files
-
334e79c968449a9ef5bb99de5379b43650f9da703eebe72c9e797d487b3d6dbbdll_JC.dll
Headers
Exports
Sections
-
out.upx
Headers
Sections