Behavioral task
behavioral1
Sample
5a58d7ebfdb7bfexeexeexeex.exe
Resource
win7-20230703-en
General
-
Target
5a58d7ebfdb7bfexeexeexeex.exe
-
Size
6.2MB
-
MD5
5a58d7ebfdb7bf25c1e38e18af13b9b4
-
SHA1
c7a40790f2d6e0fa8bdc3a6945a7a3757b2cfae9
-
SHA256
6d04a33610cd5acd46e9b7c589f22191552c36741744aef50e2bc221472a1cf8
-
SHA512
cb3f2f9252a0dd94ba55316a84f5fcbc2c35af9ebb91d968f253e56f9b6cc02a7444d7a576d387e5c6382c3435ba4b518d8d82855958cea9e01fff822b23c618
-
SSDEEP
98304:yOGpfOGpqtRvW4mjcvdsnYtgyFkhWyKawuILapIW:dGpmGpUZCby0Wy3IcIW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a58d7ebfdb7bfexeexeexeex.exe
Files
-
5a58d7ebfdb7bfexeexeexeex.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE