Encryption2
Behavioral task
behavioral1
Sample
3c95935b6a2446f435ae84b8ea6440b7a10e6392702f3c79f0a57950ca368b47.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
3c95935b6a2446f435ae84b8ea6440b7a10e6392702f3c79f0a57950ca368b47.dll
Resource
win10v2004-20231201-en
General
-
Target
3c95935b6a2446f435ae84b8ea6440b7a10e6392702f3c79f0a57950ca368b47
-
Size
76KB
-
MD5
9b2a901c5348bbb9d3c7bc12b867655c
-
SHA1
c5a4e55de9d065f1c49d0780cf2b17f5b394b198
-
SHA256
3c95935b6a2446f435ae84b8ea6440b7a10e6392702f3c79f0a57950ca368b47
-
SHA512
0cbd44af5c9e8ba9f5624e56362eece4ef6a091ad938618a0f9a237674f724d437b7100f0654e4846b3ef8a056e1464f6974e633a796fcdb69300089575bfc1a
-
SSDEEP
768:N0Cxhob6hzoihXlocxmoK1G6HZVfk4tkVvksxo7AlYOXayb/ydZL2ss9mixPQ:N0Uhob6h8slYekI72+cLB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c95935b6a2446f435ae84b8ea6440b7a10e6392702f3c79f0a57950ca368b47
Files
-
3c95935b6a2446f435ae84b8ea6440b7a10e6392702f3c79f0a57950ca368b47.dll windows:4 windows x86 arch:x86
000b7c348cf442e668d007a30c028844
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsBadReadPtr
CloseHandle
ReadFile
GetFileSize
CreateFileA
DeleteFileA
WriteFile
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetStdHandle
GetCommandLineA
HeapFree
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetWindowsDirectoryA
GetTickCount
GetProcessHeap
GetModuleFileNameA
LocalSize
GetTempPathA
GetSystemDirectoryA
user32
PeekMessageA
GetMessageA
wsprintfA
MessageBoxA
GetClassInfoExA
CreateWindowExA
DispatchMessageA
TranslateMessage
shell32
SHGetFileInfo
SHGetSpecialFolderPathA
msvcrt
??3@YAXPAX@Z
sprintf
strncmp
__CxxFrameHandler
modf
memmove
malloc
strchr
strrchr
free
_ftol
atoi
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ