Behavioral task
behavioral1
Sample
859bb27d12aae31a9d8532f452235d2e7528839e6c586395e42ae526344022f0.exe
Resource
win7-20230712-en
General
-
Target
859bb27d12aae31a9d8532f452235d2e7528839e6c586395e42ae526344022f0
-
Size
7.0MB
-
MD5
94e10741925e5c2a9ac47c1da2cb0d55
-
SHA1
1f5c5102dfa778b3a63bcfdd4d15736954135688
-
SHA256
859bb27d12aae31a9d8532f452235d2e7528839e6c586395e42ae526344022f0
-
SHA512
2885cd4669eb30620f12b664ee721d1323621a6ed141572a0c4de5e4c93258110a6967aae138cbed6a5a8f7b4424c6de2ea087cd4d95612d2c0bcb62c59612c0
-
SSDEEP
98304:kB3QJ1Xm0EQNzSiLKwESgjMxSve4NUjKwWs4:kB3QJ1Xm0EQzSiLKXSRgeazwB4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 859bb27d12aae31a9d8532f452235d2e7528839e6c586395e42ae526344022f0
Files
-
859bb27d12aae31a9d8532f452235d2e7528839e6c586395e42ae526344022f0.exe windows x86
062fd11a81683d740144db97ec53d661
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
rasapi32
RasHangUpA
kernel32
CreateToolhelp32Snapshot
user32
KillTimer
gdi32
GetTextMetricsA
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
msvcrt
strncpy
psapi
GetMappedFileNameW
Sections
.text Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 752KB - Virtual size: 752KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ