mymain
Behavioral task
behavioral1
Sample
d1ef1519791b8cc61699a5d7466f6c197c28a878646175b1404401e7ecfc49c1.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1ef1519791b8cc61699a5d7466f6c197c28a878646175b1404401e7ecfc49c1.dll
Resource
win10v2004-20241007-en
General
-
Target
d1ef1519791b8cc61699a5d7466f6c197c28a878646175b1404401e7ecfc49c1
-
Size
308KB
-
MD5
a524bb3231af6c67a5ec6d1099233468
-
SHA1
992260aaa13823089d512f039f7f63b17d6c980b
-
SHA256
d1ef1519791b8cc61699a5d7466f6c197c28a878646175b1404401e7ecfc49c1
-
SHA512
2a874117e8c413089b2ac3e2fe685196dc7b3e235ced5891429d2d946ca1b3903447a230f78eb8e77cf81ffc66cae63e94145e133e6886d5b11f5a4554421359
-
SSDEEP
3072:i8J4CCwf1n3DPy9jRX3a/LFQuvvKn3EUjV19b907La5ZDj5rM2U5rwONxj4tl5UV:BJ4Cd5a99kQz3EUjVTCLa5ZRrPEDWzm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1ef1519791b8cc61699a5d7466f6c197c28a878646175b1404401e7ecfc49c1
Files
-
d1ef1519791b8cc61699a5d7466f6c197c28a878646175b1404401e7ecfc49c1.dll windows:4 windows x86 arch:x86
8256484fa533560a4ff03fa0f822403b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyn
CreateToolhelp32Snapshot
Module32First
Module32Next
Process32First
Process32Next
WriteProcessMemory
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetLocalTime
CloseHandle
ReadFile
GetFileSize
CreateFileA
FindClose
FindFirstFileA
GetModuleFileNameA
WritePrivateProfileStringA
WriteFile
SetFilePointer
GetPrivateProfileStringA
CreateProcessA
GetStartupInfoA
GetTickCount
GetEnvironmentVariableA
FindNextFileA
GetCommandLineA
FreeLibrary
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetProcAddress
SetEndOfFile
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
IsBadWritePtr
RaiseException
GetModuleHandleA
ResumeThread
WaitForSingleObject
VirtualProtectEx
VirtualQuery
TerminateProcess
CreateWaitableTimerA
OpenProcess
GetCurrentProcessId
RtlMoveMemory
GetTimeFormatA
GetDateFormatA
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
LoadLibraryA
SetWaitableTimer
CreateThread
DeleteCriticalSection
VirtualAlloc
VirtualFree
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
user32
GetWindowThreadProcessId
EnumChildWindows
TranslateMessage
DispatchMessageA
GetWindow
EnumWindows
GetWindowRect
GetWindowInfo
MessageBoxA
wsprintfA
GetMessageA
PeekMessageA
IsWindowVisible
MsgWaitForMultipleObjects
GetWindowTextA
GetClassNameA
SetTimer
shlwapi
PathFileExistsA
PathFindFileNameA
PathFindExtensionA
oleaut32
VariantTimeToSystemTime
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
advapi32
RegCloseKey
CryptCreateHash
CryptReleaseContext
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptAcquireContextA
wininet
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
ws2_32
WSACleanup
inet_ntoa
WSAStartup
gethostbyname
Exports
Exports
Sections
.text Size: 224KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ