ETPlugin
Behavioral task
behavioral1
Sample
743cc53f7b5f3b57cd8218e8f3b9bc5222a088817098879267642a064853d369.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
743cc53f7b5f3b57cd8218e8f3b9bc5222a088817098879267642a064853d369.dll
Resource
win10v2004-20240802-en
General
-
Target
743cc53f7b5f3b57cd8218e8f3b9bc5222a088817098879267642a064853d369
-
Size
1.8MB
-
MD5
7c4e6ca71b918d030ee1409185e3dc00
-
SHA1
440d471f8c0800763206c4c6c8801cac77abcbd1
-
SHA256
743cc53f7b5f3b57cd8218e8f3b9bc5222a088817098879267642a064853d369
-
SHA512
8442489a6e1482debd6ae56ab4b8216f2b2f40bdee3aa78b13744e2ab782e5434b1acd50031831a88fe13ba81d1d495afd3aa8fa5f72fee421e0f9b10f7f3cf0
-
SSDEEP
24576:w6NPKtP7acpB97wEdA4/qOQC7G5WRbjXFTQkbERM0/zz95tYhJ3RpokGpUcq+CGO:j8tZZlDztUZEqi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 743cc53f7b5f3b57cd8218e8f3b9bc5222a088817098879267642a064853d369
Files
-
743cc53f7b5f3b57cd8218e8f3b9bc5222a088817098879267642a064853d369.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 229KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ