mymain
Behavioral task
behavioral1
Sample
12e68b45f825c8f3205c20e7963753b6f4a2afaed41c46f95a7c26442209ee0a.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
12e68b45f825c8f3205c20e7963753b6f4a2afaed41c46f95a7c26442209ee0a.dll
Resource
win10v2004-20241007-en
General
-
Target
12e68b45f825c8f3205c20e7963753b6f4a2afaed41c46f95a7c26442209ee0a
-
Size
336KB
-
MD5
eb8ac73fba71e1f838b98a2537e7ac91
-
SHA1
d92534dac1e9fcd5c4055e93bc4cdeb1d49729f1
-
SHA256
12e68b45f825c8f3205c20e7963753b6f4a2afaed41c46f95a7c26442209ee0a
-
SHA512
3eccf21238ab0fbb8e77ebc0de0eabcd6ddec204d0b15cb5d162e961bae0743b1edb83fb2e8f21d1c8ccf61d048fc4a4b23cd70f656f40538f0f6f01c6f7b0c2
-
SSDEEP
3072:ih2l8EKINRRihIp59+5v5lPfcc3FlyEUhk6NwVl0aGRP7BdHzAp5qDKKNEc2VDwO:ihbIp59+TNd6NwVlQPjw5aKP/ppFzNb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 12e68b45f825c8f3205c20e7963753b6f4a2afaed41c46f95a7c26442209ee0a
Files
-
12e68b45f825c8f3205c20e7963753b6f4a2afaed41c46f95a7c26442209ee0a.dll windows:4 windows x86 arch:x86
f67623fe4faf401b5cf17be87cb0ad88
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Module32Next
GetDateFormatA
GetTimeFormatA
Process32First
Process32Next
RtlMoveMemory
WriteProcessMemory
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
GetPrivateProfileStringA
ReadFile
GetFileSize
CreateProcessA
GetStartupInfoA
GetTickCount
GetLocalTime
WritePrivateProfileStringA
SetFilePointer
FindClose
FindFirstFileA
GetEnvironmentVariableA
FindNextFileA
GetCommandLineA
FreeLibrary
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
InterlockedExchange
Module32First
SetEndOfFile
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
HeapSize
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
RaiseException
IsBadWritePtr
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentStringsW
CreateToolhelp32Snapshot
lstrcpyn
GetProcAddress
LoadLibraryA
GetModuleHandleA
ResumeThread
VirtualQuery
SetWaitableTimer
CreateWaitableTimerA
WaitForSingleObject
GetCurrentProcessId
VirtualProtectEx
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
SetLastError
TerminateProcess
OpenProcess
CreateThread
DeleteCriticalSection
VirtualAlloc
VirtualFree
Sleep
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetLastError
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetCurrentProcess
TlsAlloc
TlsFree
user32
IsWindowVisible
MsgWaitForMultipleObjects
GetMessageA
GetWindowThreadProcessId
GetWindowTextA
GetClassNameA
SetTimer
EnumChildWindows
TranslateMessage
DispatchMessageA
GetWindow
EnumWindows
PeekMessageA
wsprintfA
MessageBoxA
GetWindowInfo
GetWindowRect
wininet
InternetSetOptionA
HttpSendRequestA
HttpOpenRequestA
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
InternetConnectA
InternetReadFile
shlwapi
PathFileExistsA
PathFindFileNameA
PathFindExtensionA
oleaut32
VariantTimeToSystemTime
advapi32
RegOpenKeyA
CryptCreateHash
CryptReleaseContext
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
ws2_32
WSACleanup
inet_ntoa
WSAStartup
gethostbyname
Exports
Exports
Sections
.text Size: 244KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ