run
Behavioral task
behavioral1
Sample
227bb4e6c7332bc5515a7a9880bef125.dll
Resource
win7-20231215-en
General
-
Target
227bb4e6c7332bc5515a7a9880bef125
-
Size
80KB
-
MD5
227bb4e6c7332bc5515a7a9880bef125
-
SHA1
18cdffd74a89bda528beb76223967de8f5eff002
-
SHA256
2c7b919a1fce5842bda70f8431763d55ae26d5582437c45f40ac18facb50813e
-
SHA512
582017508a4facaa4e19e765ac3605914109d95196754159cd5649ca38661bae2c63cacbaeb5d644e1b12320185660c63ccb309d8b10f506bd45b1967055653d
-
SSDEEP
768:NdoF/PjJaIm//39QqUHBNadrha2edb9HmZELLsdbIWRWeFWxZ:KDm/P9xUH6drU2edb9G4iSxZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 227bb4e6c7332bc5515a7a9880bef125
Files
-
227bb4e6c7332bc5515a7a9880bef125.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
�_"0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�_"1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�_"2 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE