Behavioral task
behavioral1
Sample
0506f29f0e10f7475acf78a546e43f489780fa668d7b35e78d94b236d0f1846f.exe
Resource
win7-20230712-en
General
-
Target
0506f29f0e10f7475acf78a546e43f489780fa668d7b35e78d94b236d0f1846f
-
Size
13.8MB
-
MD5
e71b33a6bd39e23bd30a4dce7894a3bd
-
SHA1
50e38bf6fbb4f020ae6964fea3cf9cb29251c3c9
-
SHA256
0506f29f0e10f7475acf78a546e43f489780fa668d7b35e78d94b236d0f1846f
-
SHA512
d7cf00eb08a48726a683996d2eec6bfd4abb7197bfd5eb3644298062c06957bbd539aee223357fb340cffcd129dc573beb1ab0c0449c389f1071a5f94a9f7fee
-
SSDEEP
393216:grcXBBXxRCPSowyGbGsXX3GJ2ozOUUwY8MAR3nIG2ic1GQ9GmmdOy49:FBBXxR5WbaX2VaZwvMAlnI/1GA/9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/out.upx family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 0506f29f0e10f7475acf78a546e43f489780fa668d7b35e78d94b236d0f1846f unpack001/out.upx
Files
-
0506f29f0e10f7475acf78a546e43f489780fa668d7b35e78d94b236d0f1846f.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 9.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 13.8MB - Virtual size: 13.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21.2MB - Virtual size: 21.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 120KB - Virtual size: 350KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 304KB - Virtual size: 302KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ