Behavioral task
behavioral1
Sample
f11de11754abe225ed3ba24c052092702a39006426465c720668ed69e4c5e528.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f11de11754abe225ed3ba24c052092702a39006426465c720668ed69e4c5e528.exe
Resource
win10v2004-20230703-en
General
-
Target
f11de11754abe225ed3ba24c052092702a39006426465c720668ed69e4c5e528
-
Size
12.9MB
-
MD5
dc8422b8106912d734e60251be8c9d6f
-
SHA1
30ba63b1b85c1a727fc733f203dc27668bf7d3b7
-
SHA256
f11de11754abe225ed3ba24c052092702a39006426465c720668ed69e4c5e528
-
SHA512
9fd96070b02b5b49134c9ddb28028d7a3ab2c61eecc2c6d3bd141f0648bc98f32003eb7e4ab196b335e57919b10a18dda88c6a4cf4450ce9ef01606b40d65d90
-
SSDEEP
98304://H5Nw9rlP6q+PybSgGGQgYkuOGlb3KFvh8PeIzb+TNDe4scLl4qKFvYk:0NZ6HPy+gG7gNGlQ8DzbY8cL+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f11de11754abe225ed3ba24c052092702a39006426465c720668ed69e4c5e528
Files
-
f11de11754abe225ed3ba24c052092702a39006426465c720668ed69e4c5e528.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 9.3MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 12.6MB - Virtual size: 12.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE