GetNewInf
Behavioral task
behavioral1
Sample
6f9669ccddeddb317d1dd41c95a542131a7e97dc464c1ab6fe0f1a49a5dd4db2.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6f9669ccddeddb317d1dd41c95a542131a7e97dc464c1ab6fe0f1a49a5dd4db2.dll
Resource
win10v2004-20231020-en
General
-
Target
6f9669ccddeddb317d1dd41c95a542131a7e97dc464c1ab6fe0f1a49a5dd4db2
-
Size
3.5MB
-
MD5
58198557d351ec52d3233d5235cc38d8
-
SHA1
396fc7ee368a221b8202176e1cb1f99b47f96d5e
-
SHA256
6f9669ccddeddb317d1dd41c95a542131a7e97dc464c1ab6fe0f1a49a5dd4db2
-
SHA512
5540c81e2101274e1536c3066e321917ce7746f6ea981b18d584c05740c5235a722cd359fcd0a7d9a89df4007a941f897d5e7003fbe7d8a5c8e18ef42f3a9a48
-
SSDEEP
24576:AcXU4RrMM88RxsJaVRi+eCEC2/kMcwCQH6YHTtlkb4Q9zaKshnZviYZTBgcmCiqm:ARWMmDi7Q6EEESAf5r
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f9669ccddeddb317d1dd41c95a542131a7e97dc464c1ab6fe0f1a49a5dd4db2
Files
-
6f9669ccddeddb317d1dd41c95a542131a7e97dc464c1ab6fe0f1a49a5dd4db2.dll windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.Silvana Size: 449B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE