�ӳ���1
Behavioral task
behavioral1
Sample
03010e352d6a7f2e1a548933265c868f1e96cb552e99107f0ad14690d0e6d087.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
03010e352d6a7f2e1a548933265c868f1e96cb552e99107f0ad14690d0e6d087.dll
Resource
win10v2004-20231020-en
General
-
Target
03010e352d6a7f2e1a548933265c868f1e96cb552e99107f0ad14690d0e6d087
-
Size
96KB
-
MD5
1f621265c6631fd51f385eead6e250bb
-
SHA1
35113d28d5dc93b7502b8b0183db4735a5957b36
-
SHA256
03010e352d6a7f2e1a548933265c868f1e96cb552e99107f0ad14690d0e6d087
-
SHA512
0cb063284127903611e563ad25eac1c874b515c731d274310a4de8a5f262aa18f1ad0f226d6c82e3c0ecbcf816ae84620a7f7f99494794d186f28b83b24a4bd8
-
SSDEEP
1536:kfGH1ia63Ed4ZRUhZ/4ciZaxjdMFwFL3avdTt61G9YhZkkxQaBMJ:k0X6OwqaSGKD9gJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03010e352d6a7f2e1a548933265c868f1e96cb552e99107f0ad14690d0e6d087
Files
-
03010e352d6a7f2e1a548933265c868f1e96cb552e99107f0ad14690d0e6d087.dll windows:4 windows x86 arch:x86
ca8ed7363e031f79d70d0d7afab0d0cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MapViewOfFile
RtlMoveMemory
GetCurrentProcessId
GetVersionExA
GetTempPathA
CopyFileA
VirtualAllocEx
GetTempFileNameA
GetSystemDirectoryA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetLogicalDriveStringsA
QueryDosDeviceA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
OpenFileMappingA
GetModuleFileNameA
LCMapStringA
GetTickCount
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
TerminateThread
DeleteCriticalSection
Sleep
CreateThread
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
RegisterWindowMessageA
GetAsyncKeyState
SetTimer
shlwapi
PathFindFileNameA
msvcrt
_stricmp
atoi
_ftol
free
malloc
srand
sprintf
_CIfmod
floor
strrchr
strchr
realloc
??3@YAXPAX@Z
strncmp
__CxxFrameHandler
modf
memmove
Exports
Exports
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 632B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ