General

  • Target

    diu.rar

  • Size

    115.9MB

  • MD5

    343590e4c1c79a3ad89481f6c0fd5fd4

  • SHA1

    22ca8a00bab74d0e4b74d66ab89d25ede598418f

  • SHA256

    254c47277797a8913ee9e13a2272bea90551e625e5813541c2838ab6f1536eed

  • SHA512

    f9012631869f749da53fd07ee4add521a6a8013c085f7be5f377566bdb1be57e41b01d0bcbee99513917697d4722dedec19643718064fc4608c92180afa36006

  • SSDEEP

    3145728:KmHCmvai2ImjnTjh9qotVeDDeU/+wJAQv495Ijc6OMBua:dHVy7nHLtL5wp48ua

Score
10/10

Malware Config

Signatures

  • Blackmoon family
  • Detect Blackmoon payload 1 IoCs
  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • diu.rar
    .rar
  • IFProtects/Protects/000
  • IFProtects/Protects/100
  • IFProtects/Protects/AAProtects.exe
    .exe windows:5 windows x86 arch:x86

    4430b7f7759f34c724e0a09c64bdb759


    Code Sign

    Headers

    Imports

    Sections

  • IFProtects/Protects/AAProtects2.exe
    .exe windows:5 windows x86 arch:x86

    4430b7f7759f34c724e0a09c64bdb759


    Code Sign

    Headers

    Imports

    Sections

  • IFProtects/Protects/DataState.dll
    .dll windows:4 windows x86 arch:x86

    c554af460571c6db4231b45e5d12aebf


    Headers

    Imports

    Exports

    Sections

  • IFProtects/Protects/madbasic_.bpl
    .dll windows:5 windows x86 arch:x86

    ae5a6a29d3cea5a63ad958cfb1a5fb0c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/Protects/maddisAsm_.bpl
    .dll windows:5 windows x86 arch:x86

    22531f752b354d949452fbdf15d6da72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/Protects/madexcept_.bpl
    .dll windows:5 windows x86 arch:x86

    2a873ab64f922b5d3d6841d9d0c267c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/Protects/rtl120.bpl
    .dll windows:5 windows x86 arch:x86

    fac06cfe16c2052ff34e27439885ff00


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/Protects/vcl120.bpl
    .dll windows:5 windows x86 arch:x86

    e8b35382b98f61463da4a5d7a3b50753


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/IWAbout.exe
    .exe windows:5 windows x86 arch:x86

    4babdc9773cc5fb85ca2b68781824b91


    Code Sign

    Headers

    Imports

    Sections

  • IFProtects/lWAbout/madbasic_.bpl
    .dll windows:5 windows x86 arch:x86

    ae5a6a29d3cea5a63ad958cfb1a5fb0c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/maddisAsm_.bpl
    .dll windows:5 windows x86 arch:x86

    22531f752b354d949452fbdf15d6da72


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/madexcept_.bpl
    .dll windows:5 windows x86 arch:x86

    2a873ab64f922b5d3d6841d9d0c267c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/rtl120.bpl
    .dll windows:5 windows x86 arch:x86

    fac06cfe16c2052ff34e27439885ff00


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/vcl120.bpl
    .dll windows:5 windows x86 arch:x86

    e8b35382b98f61463da4a5d7a3b50753


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/vclx120.bpl
    .dll windows:5 windows x86 arch:x86

    23f10bab66033603b81fd3b2e62b5516


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/webres.dll
    .dll windows:4 windows x86 arch:x86

    06dd4f4daab977961d1ec2860950c7b0


    Headers

    Imports

    Exports

    Sections

  • IFProtects/lWAbout/whelp.dat
  • active/WebUnion.abl
  • active/WebUnion.exe
    .exe windows:4 windows x86 arch:x86

    ab97d66853a10ee4a153a7ffc761f7f7


    Headers

    Imports

    Sections

  • active/WebUnion.txt
  • active/f_ini.dll
    .dll windows:5 windows x86 arch:x86

    17ed125134b8de5a8f153adcde6aadcb


    Headers

    Imports

    Exports

    Sections

  • d86645adc1cdc9e4ad55f0bb801525e5f08a4c52efbf8043ad4fffcfaa311cef/Dism.exe
    .exe windows:10 windows x64 arch:x64

    1554dc6dbc2e5d878c14e034182ba418


    Code Sign

    Headers

    Imports

    Sections

  • d86645adc1cdc9e4ad55f0bb801525e5f08a4c52efbf8043ad4fffcfaa311cef/Document.pdf.lnk
    .lnk
  • d86645adc1cdc9e4ad55f0bb801525e5f08a4c52efbf8043ad4fffcfaa311cef/config.json
  • d86645adc1cdc9e4ad55f0bb801525e5f08a4c52efbf8043ad4fffcfaa311cef/dismcore.dll
    .dll windows:4 windows x64 arch:x64

    1529a26ca4cf87244e40da4095e26534


    Headers

    Imports

    Exports

    Sections

  • fgyjk/03F76412C9334BF.abl
  • fgyjk/03F76412C9334BF.exe
    .exe windows:4 windows x86 arch:x86

    ab97d66853a10ee4a153a7ffc761f7f7


    Headers

    Imports

    Sections

  • fgyjk/03F76412C9334BF.txt
  • fgyjk/f_ini.dll
    .dll windows:5 windows x86 arch:x86

    17ed125134b8de5a8f153adcde6aadcb


    Headers

    Imports

    Exports

    Sections

  • wyanoc/Agghosts.exe
    .exe windows:6 windows x86 arch:x86

    2913e942df927fbdbac4c53d3b834572


    Code Sign

    Headers

    Imports

    Sections

  • wyanoc/Enpud.png
  • wyanoc/QiDianBrowserMgr.dll
    .dll windows:6 windows x86 arch:x86

    8ef6cb9c8799862f6a72badb5b678be7


    Headers

    Imports

    Exports

    Sections

  • wyanoc/vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    dbf59b100b5a77256457cf057352b441


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xiuxiu-/libcef.dll
    .dll windows:4 windows x86 arch:x86

    d82249b9b62ac904d2c332e637e06ffe


    Headers

    Imports

    Exports

    Sections

  • xiuxiu-/webprocess.exe
    .exe windows:6 windows x86 arch:x86

    d2a788d0de1cdf45e0de4823a4773af3


    Code Sign

    Headers

    Imports

    Sections