Behavioral task
behavioral1
Sample
528d3317e0ebd07fe0687535a62ce0c76506406c5a988f436ce89bad8e4d5c5d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
528d3317e0ebd07fe0687535a62ce0c76506406c5a988f436ce89bad8e4d5c5d.exe
Resource
win10v2004-20230703-en
General
-
Target
528d3317e0ebd07fe0687535a62ce0c76506406c5a988f436ce89bad8e4d5c5d
-
Size
161KB
-
MD5
f1ab1e1bc627749ff779fe2a0bb07171
-
SHA1
77c2f3c821d1c1a0e603951c988eaab3b5401957
-
SHA256
528d3317e0ebd07fe0687535a62ce0c76506406c5a988f436ce89bad8e4d5c5d
-
SHA512
4e4ea0ad9849eb654e710124689aa07247b2b3f93c1017535d15d788dd2a7e6dcbcbbeb3ce6b59287a00c0bfc7a48680f1637e3c80d38dc2364610ae122af7e1
-
SSDEEP
3072:8xwiu5PY2wj0kcqSz2uiKoIksbmH396tq8v3IIz1AuiO:8xePY7i2ubTRmHt6Dg27iO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 528d3317e0ebd07fe0687535a62ce0c76506406c5a988f436ce89bad8e4d5c5d
Files
-
528d3317e0ebd07fe0687535a62ce0c76506406c5a988f436ce89bad8e4d5c5d.exe windows x86
bdf779a20287e7157b98705a7896af16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
DeleteFileA
WriteFile
CreateFileA
HeapAlloc
WaitForSingleObject
CreateProcessA
GetStartupInfoA
Sleep
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetProcessHeap
ResumeThread
SuspendThread
CloseHandle
OpenThread
SetFileAttributesA
OpenProcess
advapi32
GetTokenInformation
LookupAccountSidA
OpenProcessToken
user32
PeekMessageA
wsprintfA
TranslateMessage
DispatchMessageA
MessageBoxA
GetWindowThreadProcessId
FindWindowA
GetMessageA
msvcrt
__CxxFrameHandler
sprintf
atoi
_ftol
_CIfmod
strrchr
strchr
modf
malloc
??3@YAXPAX@Z
memmove
free
strncmp
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 115KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ