Behavioral task
behavioral1
Sample
0df73956060a0053a5631c87e89de28237c2d0b88b72c8350ff394e1e41549ab.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0df73956060a0053a5631c87e89de28237c2d0b88b72c8350ff394e1e41549ab.exe
Resource
win10v2004-20230915-en
General
-
Target
0df73956060a0053a5631c87e89de28237c2d0b88b72c8350ff394e1e41549ab
-
Size
440KB
-
MD5
ae319f2385ed331c42b29d7db1bafe2e
-
SHA1
3ec913f67589a0ebbfc7e0ffe630eff0e7bbfce8
-
SHA256
0df73956060a0053a5631c87e89de28237c2d0b88b72c8350ff394e1e41549ab
-
SHA512
826149752f557fec504560333d32c75c0df8d50e2f3b00c0d79808ea37ac77c7025c1380e493e0354b9fd32b5b99c352ae0e7aefde7bd8c3252289992ccd4b68
-
SSDEEP
6144:afdvsFl5SkCVXnrzjbvZ+Lm6a+yPJylfyL6UGCbqZ5DwOoz9JO6s:Y1Al5StXnrlN6QSfyL6PDwzz9JO6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0df73956060a0053a5631c87e89de28237c2d0b88b72c8350ff394e1e41549ab
Files
-
0df73956060a0053a5631c87e89de28237c2d0b88b72c8350ff394e1e41549ab.exe windows x86
d16d7fea9f89bb9eb77c2a4e253fc228
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
WideCharToMultiByte
LocalAlloc
CreateDirectoryW
LocalFree
RtlMoveMemory
WaitForSingleObject
TerminateProcess
CloseHandle
GetCurrentDirectoryW
GetCurrentProcessId
OpenProcess
GetCurrentProcess
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetUserDefaultLCID
IsBadCodePtr
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
WriteFile
SetFileAttributesA
DeleteFileA
GetTickCount
SetFilePointer
GetCommandLineA
LoadLibraryA
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
FlushFileBuffers
SetStdHandle
LCMapStringW
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
RaiseException
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
RtlUnwind
GetVersion
GetStartupInfoA
DeleteCriticalSection
CreateThread
user32
GetSystemMetrics
PeekMessageA
GetMessageA
TranslateMessage
SetTimer
CallWindowProcA
KillTimer
MessageBoxA
wsprintfA
DispatchMessageA
shlwapi
PathIsDirectoryW
PathFileExistsA
shell32
ShellExecuteExW
ole32
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
wininet
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetReadFile
InternetGetConnectedState
InternetOpenUrlA
HttpQueryInfoA
oleaut32
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 160KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE