Behavioral task
behavioral1
Sample
baa7764a9d945d6b43037e2939b547c1a9bac9092c8f66cc9d92fe7a5a8fb033.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
baa7764a9d945d6b43037e2939b547c1a9bac9092c8f66cc9d92fe7a5a8fb033.exe
Resource
win10v2004-20230703-en
General
-
Target
baa7764a9d945d6b43037e2939b547c1a9bac9092c8f66cc9d92fe7a5a8fb033
-
Size
1.5MB
-
MD5
2b59a516e749a5e31fa4fdac325fa9ce
-
SHA1
dccc3603b64d1c43fc7ae1a52ed025e0ac12c678
-
SHA256
baa7764a9d945d6b43037e2939b547c1a9bac9092c8f66cc9d92fe7a5a8fb033
-
SHA512
b55acf932aec25e94fbb68f29a2547aba9495a956fb2c7f564955bd613b24b98fee34c19d7daf954c859e78a859f3760c0c115ce08a3fde04eca5a9142af7128
-
SSDEEP
24576:GZEPdZuNpUTX7aBCmB/3q7rcsOWqn0KqtCgmqWA3ht9TNxMDqnEyLVpe:GZUZ2pyHle0GdihTNxQyy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource baa7764a9d945d6b43037e2939b547c1a9bac9092c8f66cc9d92fe7a5a8fb033
Files
-
baa7764a9d945d6b43037e2939b547c1a9bac9092c8f66cc9d92fe7a5a8fb033.exe windows x86
2eba4be523b467d7f821219ae557ddf5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
StrToIntExW
StrToIntW
ws2_32
ntohl
recvfrom
select
sendto
socket
getaddrinfo
WSAStartup
WSACleanup
freeaddrinfo
closesocket
kernel32
FlushFileBuffers
SetStdHandle
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
CreateWaitableTimerA
SetWaitableTimer
GetCurrentProcess
OpenProcess
LocalAlloc
LocalFree
CloseHandle
WriteFile
lstrlenW
RtlMoveMemory
RtlZeroMemory
HeapAlloc
HeapFree
WideCharToMultiByte
MultiByteToWideChar
lstrcmpW
HeapCreate
HeapDestroy
lstrcmpiW
GetProcessHeap
lstrlenA
lstrcmpA
VirtualAlloc
GetModuleHandleA
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
GetLocalTime
Sleep
GetUserDefaultLCID
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
GetTickCount
CreateDirectoryA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TerminateProcess
VirtualFree
LCMapStringW
SetFilePointer
IsBadWritePtr
RaiseException
GetVersionExA
RtlUnwind
GetEnvironmentVariableA
GetVersion
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
UnhandledExceptionFilter
user32
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
ole32
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoUninitialize
oleaut32
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayGetUBound
winhttp
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpSendRequest
WinHttpOpen
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryHeaders
WinHttpConnect
Sections
.text Size: 420KB - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ