Behavioral task
behavioral1
Sample
e7ce9e4bc4e3dd8936e06d228d24fb0c22894d2d325e83f5af05a28a9d78de18.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e7ce9e4bc4e3dd8936e06d228d24fb0c22894d2d325e83f5af05a28a9d78de18.exe
Resource
win10v2004-20230220-en
General
-
Target
e7ce9e4bc4e3dd8936e06d228d24fb0c22894d2d325e83f5af05a28a9d78de18
-
Size
136KB
-
MD5
dc40ff81ec454c03b1c0197d0a32e733
-
SHA1
098f7c8b3bdfd05bee0d6e6aee3f3cd9bc4d61e7
-
SHA256
e7ce9e4bc4e3dd8936e06d228d24fb0c22894d2d325e83f5af05a28a9d78de18
-
SHA512
9b95bada2d027d9b3b76fd4b7822b323b5f64d5523de24f9e65ace6b11a0660e445c66d83b2f6db41e3646e2f835fe1526bfd44efadd2ffaba98aa05c82239f9
-
SSDEEP
3072:S7GS8A4C05r8Am+TdEtB5UH1SLC5deNLeUYt9t6i:S7N9053kUVA+td
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource e7ce9e4bc4e3dd8936e06d228d24fb0c22894d2d325e83f5af05a28a9d78de18
Files
-
e7ce9e4bc4e3dd8936e06d228d24fb0c22894d2d325e83f5af05a28a9d78de18.exe windows x86
5e76352c91de71bdea14a9574e6b897e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushFileBuffers
SetFilePointer
GetCurrentProcess
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
GlobalFlags
lstrcmpA
GetProcessVersion
LoadLibraryA
FreeLibrary
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GetProcAddress
GetLastError
SetLastError
GetVersion
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalAlloc
GlobalReAlloc
GlobalLock
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
GetCurrentThreadId
lstrlenA
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
RtlUnwind
RaiseException
HeapSize
TerminateProcess
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
Sleep
GetModuleHandleA
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
InterlockedExchange
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetModuleFileNameA
ReadConsoleA
GetStdHandle
WriteFile
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetCommandLineA
GlobalDeleteAtom
user32
wsprintfA
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
SetWindowsHookExA
GrayStringA
DrawTextA
TabbedTextOutA
DestroyMenu
PostQuitMessage
ClientToScreen
PtInRect
GetClassNameA
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorA
IsWindowEnabled
SetWindowTextA
LoadIconA
PostMessageA
MapWindowPoints
GetSysColor
SetFocus
AdjustWindowRectEx
GetClientRect
CopyRect
EnableWindow
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
LoadStringA
UnhookWindowsHookEx
SendMessageA
GetKeyState
CallNextHookEx
gdi32
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetStockObject
GetObjectA
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
comctl32
ord17
Sections
.text Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ