PTDujianz
Behavioral task
behavioral1
Sample
5d403c170d32c4195e2c61a0a89ebb23fdcc41d3a54bb59912b83271af7f1f83.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5d403c170d32c4195e2c61a0a89ebb23fdcc41d3a54bb59912b83271af7f1f83.dll
Resource
win10v2004-20230915-en
General
-
Target
5d403c170d32c4195e2c61a0a89ebb23fdcc41d3a54bb59912b83271af7f1f83
-
Size
1004KB
-
MD5
43eefd39a9e017a90864ce565ecfffca
-
SHA1
b9675b5696b92ee2f6870fa7496a6c1c00f61861
-
SHA256
5d403c170d32c4195e2c61a0a89ebb23fdcc41d3a54bb59912b83271af7f1f83
-
SHA512
84036b77eecda4abae29f42a6430190734e2d9ce6ea2d7912d2b0047e2500181e88b68f9e58c50df5a71b945505352528d1c4993154d4773b1c555dc135ba599
-
SSDEEP
24576:nBzbX0uARTDNYAz91BmL8MK4Woj2VIs2R6H4bB:nBHXbCDW6XB2hxeSR6H4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d403c170d32c4195e2c61a0a89ebb23fdcc41d3a54bb59912b83271af7f1f83
Files
-
5d403c170d32c4195e2c61a0a89ebb23fdcc41d3a54bb59912b83271af7f1f83.dll windows:4 windows x86
3919f2d724d7fc1bc18481a7bdb7c953
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
SetFileAttributesA
GetTickCount
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
Sleep
GetPrivateProfileStringA
GetCommandLineA
GetModuleFileNameA
FreeLibrary
WriteFile
LoadLibraryA
LCMapStringA
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
MultiByteToWideChar
GetLastError
MoveFileA
GetProcAddress
CreateDirectoryA
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetCurrentProcess
WideCharToMultiByte
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RaiseException
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
SetStdHandle
FlushFileBuffers
user32
mouse_event
GetAsyncKeyState
IsWindow
GetWindowThreadProcessId
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
advapi32
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCloseKey
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
Exports
Exports
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 896KB - Virtual size: 986KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ