_�����ӳ���
Behavioral task
behavioral1
Sample
d43343531a6a40d3734516d3ae1a13c3e112833cc93f200087c9ea98f77ecce6.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d43343531a6a40d3734516d3ae1a13c3e112833cc93f200087c9ea98f77ecce6.dll
Resource
win10v2004-20230915-en
General
-
Target
d43343531a6a40d3734516d3ae1a13c3e112833cc93f200087c9ea98f77ecce6
-
Size
164KB
-
MD5
5b0198361b19913b218a8057f53bf6e5
-
SHA1
8e1a614ae739684a4ebd1fcd83fd10a17005d1ce
-
SHA256
d43343531a6a40d3734516d3ae1a13c3e112833cc93f200087c9ea98f77ecce6
-
SHA512
a3ffeca0fec3e466cbd06874b49518f2248cb387466593fd8b31fbff7705f877391d5b260fa1ec27ae121fa99e99a02c1edbf4b23787e586600a260158d8dc12
-
SSDEEP
3072:DRf88+uOCxrml28KRS85Ul9oLCqqJiuUgZ1mXIM:DRf88+uul1YUl9oLCqqJvZEYM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d43343531a6a40d3734516d3ae1a13c3e112833cc93f200087c9ea98f77ecce6
Files
-
d43343531a6a40d3734516d3ae1a13c3e112833cc93f200087c9ea98f77ecce6.dll windows:4 windows x86
e4dc19a42d50c801dd3d802b67f5f433
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetPrivateProfileStringA
WritePrivateProfileStringA
CloseHandle
ReadFile
GetFileSize
CreateFileA
Sleep
GetTickCount
GetProcessHeap
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CreateThread
WideCharToMultiByte
MultiByteToWideChar
Process32Next
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
CreateToolhelp32Snapshot
GetCommandLineA
VirtualProtect
DeleteCriticalSection
user32
GetAsyncKeyState
SetCursorPos
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetSystemMetrics
wsprintfA
MessageBoxA
SetLayeredWindowAttributes
SetWindowPos
FindWindowExA
wininet
InternetOpenA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
msvcrt
calloc
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
free
malloc
atoi
_ftol
strrchr
strchr
modf
realloc
memmove
strncmp
__CxxFrameHandler
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 632B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ