Behavioral task
behavioral1
Sample
b1149560481dc7fef4514c64de0824ac931b163733ac1ca79096d8ffe1dfabd9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b1149560481dc7fef4514c64de0824ac931b163733ac1ca79096d8ffe1dfabd9.exe
Resource
win10v2004-20230703-en
General
-
Target
b1149560481dc7fef4514c64de0824ac931b163733ac1ca79096d8ffe1dfabd9
-
Size
3.1MB
-
MD5
35daf315bb83d0170ffa997bea9e1cae
-
SHA1
138d3dc87926ea29e234cfb36ccd47725f2032ee
-
SHA256
b1149560481dc7fef4514c64de0824ac931b163733ac1ca79096d8ffe1dfabd9
-
SHA512
411f6441fb13ffe34eb0a3352303ce1f5662251d36e9773e67f82e7a248b0decfe6dc4c53778aa909c8abe1507dc7f9e6171c0104c668c0c26f47d1880342872
-
SSDEEP
98304:PfJ7g/WzWXVzTX0N4f5BhBChbF4LJ9lhp2VI:J0/0WlzoN4f5pCh+7T
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1149560481dc7fef4514c64de0824ac931b163733ac1ca79096d8ffe1dfabd9
Files
-
b1149560481dc7fef4514c64de0824ac931b163733ac1ca79096d8ffe1dfabd9.exe windows x86
354f813f9662d8a36a6856caf247a130
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
GetModuleHandleA
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
GetCommandLineA
RtlMoveMemory
VirtualFree
VirtualAlloc
lstrcpynA
CreateFileW
HeapSize
MoveFileA
GetTickCount
CreateDirectoryA
GetStringTypeW
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
HeapSetInformation
GetStartupInfoW
RtlUnwind
SetUnhandledExceptionFilter
GetModuleHandleW
DecodePointer
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LoadLibraryW
Sleep
RaiseException
SetStdHandle
FlushFileBuffers
WriteConsoleW
user32
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
PeekMessageA
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ