patch
Behavioral task
behavioral1
Sample
819d8d589f0b721e7dd1e2dcd697ffd845d69a77d2d984bd9cb7f53c42000551.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
819d8d589f0b721e7dd1e2dcd697ffd845d69a77d2d984bd9cb7f53c42000551.dll
Resource
win10v2004-20231222-en
General
-
Target
819d8d589f0b721e7dd1e2dcd697ffd845d69a77d2d984bd9cb7f53c42000551.exe
-
Size
140KB
-
MD5
5e8451ec5e525b595401b274fae7c45d
-
SHA1
f41062e6e4a9d29a4f9d519897baf246b18113c0
-
SHA256
819d8d589f0b721e7dd1e2dcd697ffd845d69a77d2d984bd9cb7f53c42000551
-
SHA512
3def7e73e22d74da0ee960540512c5ee8e11dfb2398c5d42b6e9a8fea363d2fa5f61645d5b255a08ec28025b2508ac61a51c6a3065efb0d2456ffa728dc35167
-
SSDEEP
1536:FrfTzYLIJeuhYxBSwnT2sCPt8edbh2ZAp9RndXMA1IFdtf:Fr7peFkhlFRndjOFdt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 819d8d589f0b721e7dd1e2dcd697ffd845d69a77d2d984bd9cb7f53c42000551.exe
Files
-
819d8d589f0b721e7dd1e2dcd697ffd845d69a77d2d984bd9cb7f53c42000551.exe.dll windows:4 windows x86 arch:x86
d937c5ab73e7fd78914f2fec050e2474
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
WriteFile
CreateFileA
DeleteFileA
FindNextFileA
FindFirstFileA
FindClose
GetCommandLineA
IsBadReadPtr
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
WriteProcessMemory
ReadProcessMemory
OpenProcess
GetModuleFileNameA
VirtualAllocEx
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualFree
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
RaiseException
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
SetUnhandledExceptionFilter
IsBadCodePtr
SetStdHandle
FlushFileBuffers
user32
MessageBoxA
DispatchMessageA
TranslateMessage
wsprintfA
GetMessageA
PeekMessageA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ