blackhole-d3d-windows-x64.zip
- SHA256 c72b827657bda658d709e52e90226dbd21a97231ef1a862b66f77b0bc8908799
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
blackhole-d3d-windows-Release/BlackHoleRestNativeD3D.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
blackhole-d3d-windows-Release/BlackHoleRestNativeD3D.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target blackhole-d3d-windows-x64.zip
- Size 123KB
- Sample261113-xnvjpsft91
- SHA256 c72b827657bda658d709e52e90226dbd21a97231ef1a862b66f77b0bc8908799
- MD5 a57724816260a5d0dd95c2bd4eaddbc4
- SHA1 d6b992499ee41c38dc6adbec376781f9925d202c
- SHA512 bdc0a5e339d950125c19467c48aef67ddcea7c8f39d0694f6f6f8572f078778a1d92aa9307a65c51cf138d31241bdb003bf09f78224871d9985b3287e41f945c
- SSDEEP 3072:ce/plidajLdF4voZJA9LuYNYyANp2vbMKSQOUtZrk2WmzYI:ceRMdaXjiw60YNBANaaQOUtPWmzX
- TLSH T152C312125303F8128D2C1C74899AB1DE967BEA43F6E9A3DCB330B35AB4975C8C46D85D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/blackhole-d3d-windows-Release/BlackHoleRestNativeD3D.exe
File Explorer
-
blackhole-d3d-windows-x64.zip.zip 123KB
-
blackhole-d3d-windows-Release/BlackHoleOverlay.hlsl13KB
-
blackhole-d3d-windows-Release/BlackHoleRestNativeD3D.exe.exe 417KB
-
blackhole-d3d-windows-Release/README.txt220B
blackhole-d3d-windows-Release/BlackHoleOverlay.hlsl
- SHA256 3f0405c6db34abcf38489dc65dc3a2da832e9579c696b0ab71ea10c7c831d017
- MD5 65f411a99f16d22e1e6b3f0ba1e23401
- SHA1 4c008e553a24ccc8629d0c2e39c9af84e5cb65dd
- SHA512 c05baa034dbfccb9200f66d5ee5f84dce1512237a0cc8a0c7dc413982d2271931c6c92a6ab0a0119b6eedd6e6ea5c73abdb5f26cc439c076b1d7dada985fe44a
- SSDEEP 192:k/qH2Ke10Y9uHwjvSE+D7JDmhiQGr7S/tPRJVkEmP8bc3U1x/YRRImBki49ML:1XH5nDpmU/S/imdY7Iwk9o
- TLSH T1BB52DE8C27C294114EB9A65DCF134208D34696E76E648740F64C6726AFB302FCE79EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
blackhole-d3d-windows-Release/BlackHoleRestNativeD3D.exe
- IMPHASH dfafada73fffc415b5ba557c9512be67
- SHA256 849bea4305f899af8a662695cf8950707f6053b89976f44c8f8a64724e631a9e
- MD5 52b0921f435ab8e258af983faa40590a
- SHA1 3fafc3add05a9494f6a04cbe379b050e5217e99b
- SHA512 5def0f82a31d8013f50bf3b82773c152cb67c1284161fd241580edea6f7c6232c88cfbd9c4ffe28293a3bbefaabf78119803c25ef9761bc218775de111353101
- SSDEEP 6144:DQiPkiID3SOQIatzyizonSqSkVJ/IH9Jr8GldOnUrTdZvSkHaNSnSASSaS1SrSWo:9WalOVJ7e
- TLSH T168948BCD027BB0C7E3970B7CAC587B6846344BF1642015A7359036E6AB57E7A2A72733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
26916
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DCompileFromFile
dcomp
DCompositionCreateDevice
user32
SetForegroundWindow
AppendMenuW
GetCursorPos
GetClientRect
TrackPopupMenuEx
UpdateWindow
DestroyMenu
CreatePopupMenu
GetSystemMetrics
SetWindowDisplayAffinity
SetWindowPos
ShowWindow
CreateWindowExW
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
LoadIconW
DestroyIcon
TranslateMessage
SetProcessDpiAwarenessContext
MessageBoxA
DispatchMessageW
PeekMessageW
RegisterHotKey
UnregisterHotKey
RegisterClassExW
DefWindowProcW
PostQuitMessage
LoadImageW
gdiplus
GdiplusStartup
GdiplusShutdown
kernel32
InitializeSListHead
UnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlVirtualUnwind
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
RtlLookupFunctionEntry
GetStartupInfoW
GetCurrentProcess
GetModuleHandleW
WideCharToMultiByte
GetModuleFileNameW
GetLocalTime
GetLastError
OutputDebugStringA
WriteFile
FlushFileBuffers
CreateFileW
SetCurrentDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlCaptureContext
shell32
Shell_NotifyIconW
advapi32
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
msvcp140
_Query_perf_counter
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
vcruntime140
__C_specific_handler
__current_exception
__current_exception_context
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
memmove
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_exit
exit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_invoke_watson
_get_wide_winmain_command_line
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
api-ms-win-crt-string-l1-1-0
wcsncpy_s
strlen
wcslen
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vswprintf
_set_fmode
__p__commode
api-ms-win-crt-math-l1-1-0
ceilf
sqrtf
sinf
roundf
fmaf
cosf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
365KB
Virtual Size
364KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=27, id=261, version=35207,
count=6, id=257, version=35207,
count=17, id=257, version=33145,
count=129, id=1, productName=Unmarked objects,
count=1, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
blackhole-d3d-windows-Release/README.txt
- SHA256 e8c93da260af0ec117d91229a62a57af993f4449f94cd9791dffa8c08f804a0a
- MD5 5c5df10c82249a4ec51d188910cde0b1
- SHA1 521f0b27dbe2352237e812395a4415faa96c09a3
- SHA512 50597efb38a3f0fb4eb65586272f5b27a90b6d4a03cdbc1ce035856af232ca00dc11580940ac00603796737bf51d7367d9c29d1e5ada925f2e221bee994bc58c
- TLSH T162D0A911A7EC4B2AA2A6020200AEA298921B860EC65C48E39CC41383288B18949A4CE9
- MD5 SHA1 SHA512 TLSH