run
Behavioral task
behavioral1
Sample
297d6818f0f3f29e80350f29a3ae58aa.dll
Resource
win7-20231215-en
General
-
Target
297d6818f0f3f29e80350f29a3ae58aa
-
Size
80KB
-
MD5
297d6818f0f3f29e80350f29a3ae58aa
-
SHA1
4fa204da4e447ca438edc780d21a67b524669d5d
-
SHA256
5820b8fd70b2cb021c50384c3e987b129561cab01f5e25f74980c0c5167bf7e5
-
SHA512
594ef00384237ebfde9c5aadbbbb86c09a2e54a9705a339c4d9a3f3df83fd569638c21393b1712a2ccd8f164f3431a385dfd5bc8703e8fa44082f6d1543ad0fa
-
SSDEEP
768:wMFz18Cn+Im/aVtQeUMQ9adrRa2Vru5dCnrcqbGfzHWxZ:x/m/2tFUMRdrk2VydCrhSfyxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 297d6818f0f3f29e80350f29a3ae58aa
Files
-
297d6818f0f3f29e80350f29a3ae58aa.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
>1i0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
>1i1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
>1i2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE