_�����ӳ���
Behavioral task
behavioral1
Sample
bc0d9160edf0aea03b9409f76f165b1343fdd05bf52f20438dccbf76dea5ae14.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bc0d9160edf0aea03b9409f76f165b1343fdd05bf52f20438dccbf76dea5ae14.dll
Resource
win10v2004-20240226-en
General
-
Target
bc0d9160edf0aea03b9409f76f165b1343fdd05bf52f20438dccbf76dea5ae14
-
Size
384KB
-
MD5
5490be53701ff4e69eabb0af3fafdea6
-
SHA1
0d0b20df8631a3c3626246f90199734104ef657b
-
SHA256
bc0d9160edf0aea03b9409f76f165b1343fdd05bf52f20438dccbf76dea5ae14
-
SHA512
906e05d27ace50b0321ac4eb9392957be1ad16ee201c176dff6cd1035d4f9849f201d3d03e3030325ac3e89a5a94f2b5866455ed4945ac518a57a06db3b2a5cc
-
SSDEEP
6144:dRC5OMPNl0JVLaJzZDQidE2HyELb69b0gLXufH+KCitqBqqAgTStrJ/S+D:doMMPNlGlaZZ56d0gLXufH+KCitqBqqM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc0d9160edf0aea03b9409f76f165b1343fdd05bf52f20438dccbf76dea5ae14
Files
-
bc0d9160edf0aea03b9409f76f165b1343fdd05bf52f20438dccbf76dea5ae14.dll windows:4 windows x86 arch:x86
ec03f86c0b29f0d3d0fbc9d28ec2624d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ContinueDebugEvent
DebugActiveProcessStop
GetCurrentThreadId
CreateRemoteThread
ReadProcessMemory
GetVersionExA
GetTempPathA
GetLogicalDriveStringsA
QueryDosDeviceA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
ReadFile
GetCurrentProcessId
WaitForDebugEvent
DeleteFileA
GetPrivateProfileStringA
Sleep
WritePrivateProfileStringA
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
MultiByteToWideChar
GetSystemDirectoryA
GetTempFileNameA
GetWindowsDirectoryA
DebugActiveProcess
CreateFileA
GetCurrentProcess
WideCharToMultiByte
VirtualAllocEx
GetFileSize
CopyFileA
user32
MessageBoxA
KillTimer
SetTimer
RemovePropA
CallWindowProcW
IsWindowUnicode
CallWindowProcA
SetWindowLongA
SetPropA
GetWindowLongA
GetPropA
GetWindowRect
IsWindow
wsprintfA
GetDesktopWindow
GetWindowTextA
GetWindowTextLengthA
GetClassNameA
IsWindowVisible
GetParent
GetWindowThreadProcessId
MsgWaitForMultipleObjects
PostThreadMessageA
GetAncestor
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindow
RegisterWindowMessageA
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
shlwapi
PathFindFileNameA
iphlpapi
GetExtendedTcpTable
msvcrt
modf
realloc
strchr
atof
strtod
_CIpow
malloc
_stricmp
free
??2@YAPAXI@Z
strrchr
??3@YAXPAX@Z
_ftol
atoi
floor
sprintf
_CIfmod
strncmp
__CxxFrameHandler
memmove
srand
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: 348KB - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ