FG
Behavioral task
behavioral1
Sample
9ca8c23146d2f1972712c9e2ba12b6b7d3a0a2faa023f67d0c1296777096f126.dll
Resource
win7-20240903-en
General
-
Target
9ca8c23146d2f1972712c9e2ba12b6b7d3a0a2faa023f67d0c1296777096f126
-
Size
328KB
-
MD5
ffd6478b90285c63ca5fe493e50680f9
-
SHA1
9b2952816dc152377bdb9e854f048c60f0e2465a
-
SHA256
9ca8c23146d2f1972712c9e2ba12b6b7d3a0a2faa023f67d0c1296777096f126
-
SHA512
35e54151797fd55a573f292302d29deb781b93a1eb1ff5bd21d3f80a466249185c41dd5cb49785afd3744e9f9d2c7b73e399ee1801ac4856b60100105f50ad49
-
SSDEEP
1536:XlENiEwMzCs81CiOEZQuSA2SAyh15tUwjs5QBwljtlGNSSA/fffypSPalsvcIti6:XSiEwMocpiPNaI3/uC7gfg+xgiFT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9ca8c23146d2f1972712c9e2ba12b6b7d3a0a2faa023f67d0c1296777096f126
Files
-
9ca8c23146d2f1972712c9e2ba12b6b7d3a0a2faa023f67d0c1296777096f126.dll windows:4 windows x86 arch:x86
3bf1a5654615193df489ccc1c5adbe37
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TerminateProcess
CloseHandle
ReadProcessMemory
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
OpenProcess
IsBadReadPtr
GetPrivateProfileStringA
DeleteFileA
Sleep
GetTickCount
GetCommandLineA
GetModuleFileNameA
LCMapStringA
GetCurrentProcess
HeapFree
WriteProcessMemory
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
IsWindow
CallNextHookEx
SetWindowsHookExA
GetWindowThreadProcessId
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
atoi
_ftol
sprintf
srand
strrchr
malloc
free
modf
memmove
strncmp
__CxxFrameHandler
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.svmp1 Size: 288KB - Virtual size: 286KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ