aac
Behavioral task
behavioral1
Sample
eceb63f9ec284e54d086200361337c17e92349300833ef3af8086de0f21dd094.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
eceb63f9ec284e54d086200361337c17e92349300833ef3af8086de0f21dd094.dll
Resource
win10v2004-20240226-en
General
-
Target
eceb63f9ec284e54d086200361337c17e92349300833ef3af8086de0f21dd094
-
Size
132KB
-
MD5
75aca95ab958d0a41475e25c54a2d489
-
SHA1
61d9d0cfb2f249031d5a223d1f092305ae5cccea
-
SHA256
eceb63f9ec284e54d086200361337c17e92349300833ef3af8086de0f21dd094
-
SHA512
3039a0c62cfbb63e871de875a67a7ddbc1dce3ef83b155e020d42124cf0b3152dbadd570b82554d86577c0ee2ab3c34297424a9fcf59b723c4c34197364995ee
-
SSDEEP
1536:r4lfkRhwhdAqSGOYAKyZZeBhPTbVdG1D58pRNzICMATJ/Wv2yU9+/znIui9l8iWy:rWfOXW/Nzj1s0KrMiOB8tTnU0Axs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eceb63f9ec284e54d086200361337c17e92349300833ef3af8086de0f21dd094
Files
-
eceb63f9ec284e54d086200361337c17e92349300833ef3af8086de0f21dd094.dll windows:4 windows x86 arch:x86
4fbc79c5742cfd34dd0b8b5cf1b500c7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
CreateThread
UnmapViewOfFile
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
DeleteFileA
WriteFile
CreateFileA
GetCommandLineA
GetModuleFileNameA
LCMapStringA
GetProcAddress
GetModuleHandleA
VirtualAlloc
lstrcpyn
CloseHandle
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
RaiseException
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
SetWaitableTimer
CreateWaitableTimerA
GetStartupInfoA
GetFileType
GetStdHandle
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
user32
MessageBoxA
wsprintfA
PeekMessageA
GetMessageA
TranslateMessage
MsgWaitForMultipleObjects
DispatchMessageA
ole32
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
oleaut32
SysAllocString
VariantClear
SafeArrayCreate
VariantCopy
RegisterTypeLi
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
SafeArrayDestroy
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ