Behavioral task
behavioral1
Sample
150a1707894fbcd0614f4947a8beddb8c228f37789363d1a2c1e5f0c8a114d20.exe
Resource
win7-20230831-en
General
-
Target
150a1707894fbcd0614f4947a8beddb8c228f37789363d1a2c1e5f0c8a114d20
-
Size
9.4MB
-
MD5
df022ce31bd227e0e52fbc31f84952cb
-
SHA1
cef1946a73763d0b3072e2bac006f053c486cfe8
-
SHA256
150a1707894fbcd0614f4947a8beddb8c228f37789363d1a2c1e5f0c8a114d20
-
SHA512
936ab17ba5a25dc87b47065175b895b9d6345d9050146d41cb0381537c2fb2e4f5d005801c48e2b8d3e873fc2969b8d89c2d90fe925796938ba2e54fa78aa622
-
SSDEEP
196608:IRZ2EUMlupztwdBRcet/X0dkZi5sUF26W2QFtJbB:uZOMluEcA8kOsUkwQFtJ1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 150a1707894fbcd0614f4947a8beddb8c228f37789363d1a2c1e5f0c8a114d20
Files
-
150a1707894fbcd0614f4947a8beddb8c228f37789363d1a2c1e5f0c8a114d20.exe windows x86
d28e55cf79cb9611fbafce63a4225228
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetModuleHandleA
GetProcAddress
MultiByteToWideChar
FindFirstFileW
FindClose
CreateWaitableTimerA
SetWaitableTimer
GetCurrentProcess
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetFileAttributesA
GetPrivateProfileStringA
WideCharToMultiByte
GetUserDefaultLCID
GetWindowsDirectoryA
GetEnvironmentVariableA
WriteFile
CreateFileA
Sleep
GetTickCount
GetStartupInfoA
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
GetShortPathNameA
WaitForSingleObject
CreateProcessA
RtlMoveMemory
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
LocalFree
FlushFileBuffers
SetStdHandle
LCMapStringW
IsBadCodePtr
LocalAlloc
GetCurrentProcessId
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RaiseException
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
GetStringTypeW
GetTempPathA
GetVersionExA
GetLastError
GetVersion
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetStringTypeA
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
WaitForInputIdle
MessageBoxA
MsgWaitForMultipleObjects
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueExA
CreateProcessAsUserA
LookupAccountSidA
ole32
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
oleaut32
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ