Behavioral task
behavioral1
Sample
2f3a3e776bcdeb21ef0e530be052231ffb2c0cc541c7083c646a4c24b9befe5a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2f3a3e776bcdeb21ef0e530be052231ffb2c0cc541c7083c646a4c24b9befe5a.exe
Resource
win10v2004-20230220-en
General
-
Target
2f3a3e776bcdeb21ef0e530be052231ffb2c0cc541c7083c646a4c24b9befe5a
-
Size
4.3MB
-
MD5
ea3e9d19106196e24b10b15d2ae9210d
-
SHA1
0194afbf5ccd49db5e168815b31b19871b8fdb7f
-
SHA256
2f3a3e776bcdeb21ef0e530be052231ffb2c0cc541c7083c646a4c24b9befe5a
-
SHA512
8472297798911213ef8eec4a943898978463756e89a3295f3a4ad12d6a26669cfb9c0c18bfc176d549f99e7b3b0e15a6b06803cbf2040c9aa79d5691f00b55a5
-
SSDEEP
98304:XqlBDmLNAlORoPZ6YCSEvDAKOHG2eSgw41WSqBgZT4kxL4tbezpJ:XqvtkiR6YCSEvKm4IqiZ3YeNJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2f3a3e776bcdeb21ef0e530be052231ffb2c0cc541c7083c646a4c24b9befe5a
Files
-
2f3a3e776bcdeb21ef0e530be052231ffb2c0cc541c7083c646a4c24b9befe5a.exe windows x86
93fe3cafd3f86865481f61dd463e76b5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
RtlMoveMemory
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetProcessHeap
GetModuleHandleA
ExitProcess
SetWaitableTimer
HeapReAlloc
HeapFree
IsBadReadPtr
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateWaitableTimerA
HeapAlloc
CreateProcessA
user32
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
msvcrt
calloc
sprintf
strrchr
_ftol
strchr
atoi
malloc
modf
free
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4.2MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ