�ӳ���1
Behavioral task
behavioral1
Sample
275c1c340a0bb98357766af805e679c2ac6f32b8cf467c4fffa69e4995a5e1b4.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
275c1c340a0bb98357766af805e679c2ac6f32b8cf467c4fffa69e4995a5e1b4.dll
Resource
win10v2004-20231020-en
General
-
Target
275c1c340a0bb98357766af805e679c2ac6f32b8cf467c4fffa69e4995a5e1b4
-
Size
52KB
-
MD5
b98bb9f54d5fc28ba0debb1f07803d6c
-
SHA1
0993138ef5890741e4ef5f66cbea0a3669df3023
-
SHA256
275c1c340a0bb98357766af805e679c2ac6f32b8cf467c4fffa69e4995a5e1b4
-
SHA512
97d359aceae08e1624e60d1f19726b0b9d06e881a865aa63ad279373c1b2b2ef741bc682ca538bbb4b7acdd978ecef3dea887bbc75240ffb4b7cb54bd3ac44fd
-
SSDEEP
384:PdQ2HuQtD6DWj54vQGyqWbbEiBxUdzZqmPRaHI+S3Yzydx7wjFcGRF3/Tx+0JCVc:PC5WD6DWxqWbbEUe4mZaH9ACRp7En+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 275c1c340a0bb98357766af805e679c2ac6f32b8cf467c4fffa69e4995a5e1b4
Files
-
275c1c340a0bb98357766af805e679c2ac6f32b8cf467c4fffa69e4995a5e1b4.dll windows:4 windows x86 arch:x86
ab30db7cac60663931b8d54917f82dc2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
GetCommandLineA
GetModuleFileNameA
ExitProcess
DeleteCriticalSection
CreateThread
CloseHandle
GetModuleHandleA
LCMapStringA
GetProcessHeap
TerminateThread
wininet
HttpQueryInfoA
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetReadFile
msvcrt
malloc
atoi
_ftol
strrchr
free
realloc
??3@YAXPAX@Z
strncmp
__CxxFrameHandler
memmove
sprintf
modf
user32
wsprintfA
TranslateMessage
GetMessageA
PeekMessageA
MessageBoxA
DispatchMessageA
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ