_�����ӳ���
Behavioral task
behavioral1
Sample
b3b6418bd2db6b77bffcc3986d1657f702a5f3252152243d3339ef3ee90b2139.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b3b6418bd2db6b77bffcc3986d1657f702a5f3252152243d3339ef3ee90b2139.dll
Resource
win10v2004-20240611-en
General
-
Target
b3b6418bd2db6b77bffcc3986d1657f702a5f3252152243d3339ef3ee90b2139
-
Size
684KB
-
MD5
6178f5cf28a1b4e77a7886ed0ae2e105
-
SHA1
66a7ace54526425f5b6e08d60dd4cd2a3c82bc15
-
SHA256
b3b6418bd2db6b77bffcc3986d1657f702a5f3252152243d3339ef3ee90b2139
-
SHA512
533b118d5eb3749cc22bcabcf66095eaddeb7192755ea1d42b3cdfb62596e206acaa5768b8caa21c54083c64b8366b9c5147f3dd260c9ed23a0869539233440f
-
SSDEEP
12288:fj4nQ9X7RZn4WXd+GXZVb7Zjbc8MKi1bvwuH:f8krRZn4Wt+GXZVb7Zjbc8MKavx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b3b6418bd2db6b77bffcc3986d1657f702a5f3252152243d3339ef3ee90b2139
Files
-
b3b6418bd2db6b77bffcc3986d1657f702a5f3252152243d3339ef3ee90b2139.dll windows:4 windows x86 arch:x86
53448bafec86e2615a23c5e7f5acc0d3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ContinueDebugEvent
DebugActiveProcessStop
CopyFileA
VirtualAllocEx
WideCharToMultiByte
GetTempFileNameA
GetSystemDirectoryA
GetVersionExA
GetTempPathA
MultiByteToWideChar
GetCurrentThreadId
GetLogicalDriveStringsA
QueryDosDeviceA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
WaitForDebugEvent
HeapFree
IsBadReadPtr
CloseHandle
ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetTickCount
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
DebugActiveProcess
VirtualFree
VirtualAlloc
IsWow64Process
HeapReAlloc
GetCurrentProcessId
advapi32
LookupPrivilegeValueA
OpenProcessToken
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
RegisterWindowMessageA
shlwapi
PathFindFileNameA
msvcrt
_stricmp
_CIfmod
sprintf
floor
atoi
_ftol
srand
free
malloc
strrchr
strchr
realloc
??3@YAXPAX@Z
modf
memmove
strncmp
__CxxFrameHandler
Exports
Exports
Sections
.text Size: 144KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 520KB - Virtual size: 577KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ