GFXDllKernelObject
Behavioral task
behavioral1
Sample
633c44114d28928f3f5e59f175ea6d1bff48654ee503bc3a42bc34c0db5d149e.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
633c44114d28928f3f5e59f175ea6d1bff48654ee503bc3a42bc34c0db5d149e.dll
Resource
win10v2004-20240508-en
General
-
Target
633c44114d28928f3f5e59f175ea6d1bff48654ee503bc3a42bc34c0db5d149e
-
Size
156KB
-
MD5
7ac584999d0dafe3bcfd03cf7a8ae0fe
-
SHA1
aa970a0e9a1f6a797094d8910de81abf02e46546
-
SHA256
633c44114d28928f3f5e59f175ea6d1bff48654ee503bc3a42bc34c0db5d149e
-
SHA512
d2758efb8fc315ccf7a5a424201e185a53eaab13a938c4a6a7d479f6cbb37c33798a888296428e8dbf185341dba8d59ea47400e2324b8af44753cfd5bf8539d9
-
SSDEEP
3072:AfWbPJd79iHX/2fDrEvtbgz6RhUc3g0Xc2tOK4tHaU5c:AI5UX/2clbgmRhUmgyciAvc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 633c44114d28928f3f5e59f175ea6d1bff48654ee503bc3a42bc34c0db5d149e
Files
-
633c44114d28928f3f5e59f175ea6d1bff48654ee503bc3a42bc34c0db5d149e.dll windows:4 windows x86 arch:x86
52d4c060bf3a5871233de6079902cb04
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
CloseHandle
VirtualAlloc
CreateThread
VirtualFree
GetComputerNameA
CreateWaitableTimerA
SetWaitableTimer
CreateToolhelp32Snapshot
Module32First
Module32Next
GetFileAttributesA
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
FindFirstFileA
FindClose
GetVersionExA
OpenProcess
LoadLibraryExA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
WriteProcessMemory
HeapFree
IsBadReadPtr
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
WriteFile
GetTickCount
GetCommandLineA
LCMapStringA
FlushFileBuffers
SetStdHandle
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
ReadProcessMemory
VirtualAllocEx
FreeLibrary
IsWow64Process
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
VirtualQueryEx
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
RtlUnwind
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
RaiseException
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
iphlpapi
GetNetworkParams
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
RegisterWindowMessageA
SetWindowLongA
IsWindowVisible
GetAncestor
GetWindowThreadProcessId
EnumWindows
MsgWaitForMultipleObjects
advapi32
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
Exports
Exports
Sections
.text Size: 116KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ