Behavioral task
behavioral1
Sample
daaedca9d071530d21839e65240c06936c105b979ec9eeefe1a1ce2d0e704bc5.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
daaedca9d071530d21839e65240c06936c105b979ec9eeefe1a1ce2d0e704bc5.exe
Resource
win10v2004-20230703-en
General
-
Target
daaedca9d071530d21839e65240c06936c105b979ec9eeefe1a1ce2d0e704bc5
-
Size
268KB
-
MD5
828814270576e46c41611a01ec1e6ae2
-
SHA1
e7f170039d7f3989589a5e6a0eecfd6141561776
-
SHA256
daaedca9d071530d21839e65240c06936c105b979ec9eeefe1a1ce2d0e704bc5
-
SHA512
c2eca21d4796bf1b6702ac3a2ddfbe86c17fdd1e13e4a6cc3a8c365d6a19546d17ceb821b3e25489eac2d6d03ea7526c6920bb2edcdbed27f5bcba4bd8abc347
-
SSDEEP
3072:WrNubIpTZxcy69H/blN99+KqDStHqzDuwdObLbxQYCTJMBLNF:CNubmncDNbiYqzLOPbaJIRF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource daaedca9d071530d21839e65240c06936c105b979ec9eeefe1a1ce2d0e704bc5
Files
-
daaedca9d071530d21839e65240c06936c105b979ec9eeefe1a1ce2d0e704bc5.exe windows x86
427e77a05f516929bcef71202489acd9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessVersion
lstrcmpA
GlobalFlags
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetCurrentProcess
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
GlobalGetAtomNameA
RtlUnwind
RaiseException
HeapSize
TerminateProcess
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
InterlockedExchange
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetLastError
SetLastError
GetVersion
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalAlloc
GlobalReAlloc
GlobalLock
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalFree
LocalAlloc
Sleep
GetCurrentThreadId
lstrlenA
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetCommandLineA
GetModuleHandleA
OpenProcess
OpenThread
Thread32Next
Thread32First
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
user32
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
IsWindowEnabled
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
GetTopWindow
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
LoadStringA
UnhookWindowsHookEx
SendMessageA
GetKeyState
CallNextHookEx
SetWindowsHookExA
FindWindowA
GetCapture
GetWindowThreadProcessId
MessageBoxA
EnableWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
GetSystemMetrics
gdi32
SelectObject
RestoreDC
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
GetObjectA
GetStockObject
SetMapMode
Escape
ExtTextOutA
TextOutA
SetWindowExtEx
ScaleWindowExtEx
PtVisible
RectVisible
CreateBitmap
psapi
GetMappedFileNameA
oleaut32
VariantTimeToSystemTime
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
comctl32
ord17
Sections
.text Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 116KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ