Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.dll
Resource
win10v2004-20241007-en
General
-
Target
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.exe
-
Size
2.9MB
-
MD5
fa83b61bd3076462a4ee6f59cdb1c3b0
-
SHA1
3dea170071d9a5502ab5592aa49feae5cec3855b
-
SHA256
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77c
-
SHA512
5634286cee6fc6a989ba4cb4625e224c2c756fd78b95b188efcb0c791b4c6ac2a5546db346770e511ff7ab52e730d1418fd2b0c32cf859c8d5378ea64e291079
-
SSDEEP
49152:0Y6LfuhifICeZNZfNpNT+3/lGFi7YtXyCbJXPqEAQ2wQrtJmzys2gzG:iLb3ejZg3NGQ7YACbStwQrtGy2zG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.exe
Files
-
3f0f1d1a44dcf56e10b90cbba9e6e693a67f7544771cb885a07e1ad09112f77cN.exe.dll windows:4 windows x86 arch:x86
0e6526b20a130e1667c41d56e6a8c85d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
timeGetTime
kernel32
VirtualAlloc
VirtualProtect
GetModuleHandleA
GetProcAddress
IsBadReadPtr
GetCurrentThreadId
RtlMoveMemory
MultiByteToWideChar
WideCharToMultiByte
VirtualProtectEx
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
DeleteFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetTickCount
GetCommandLineA
GetModuleFileNameA
LoadLibraryA
LCMapStringA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
FreeLibrary
TlsSetValue
GetOEMCP
GetACP
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
RaiseException
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetFilePointer
LCMapStringW
GetCPInfo
user32
SetTimer
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
SetWindowsHookExA
GetWindowLongA
GetWindowTextA
KillTimer
CallNextHookEx
GetAsyncKeyState
SetWinEventHook
psapi
GetModuleInformation
Sections
.text Size: 180KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ