Behavioral task
behavioral1
Sample
9c69dd81f3c92be98555b6f2debd8cec5e381d108e6f7d17e1b4220d1df6b850.exe
Resource
win7-20230831-en
General
-
Target
9c69dd81f3c92be98555b6f2debd8cec5e381d108e6f7d17e1b4220d1df6b850
-
Size
9.7MB
-
MD5
dfa1face223c9836ba057707a86de2c2
-
SHA1
6776230ded88b705c5ade92559b999b6a900a81d
-
SHA256
9c69dd81f3c92be98555b6f2debd8cec5e381d108e6f7d17e1b4220d1df6b850
-
SHA512
5007942dd6833b5fbcf3bba7dea69faa2b69a7a6e51df766ae67db18a73845e13a21861a1e09ac5ac14835d07ef4bca81da6b4431fdc12e0385d29f76f1f5e63
-
SSDEEP
196608:gHkYEcOYWunWMeZf6OTmNWukm9VXhWO+OtG1uqg6p2pM4rDbpp+sTN:FYtOYW3Zfr6NWuk0phWO1MuCp2m4rDf3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c69dd81f3c92be98555b6f2debd8cec5e381d108e6f7d17e1b4220d1df6b850
Files
-
9c69dd81f3c92be98555b6f2debd8cec5e381d108e6f7d17e1b4220d1df6b850.exe windows:5 windows x86
3e25982a745b6e08826ed5233fcced68
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetForegroundWindow
CharUpperBuffW
gdi32
ExtSelectClipRgn
winmm
waveOutGetNumDevs
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
WSACleanup
comdlg32
GetFileTitleA
Sections
Size: 808KB - Virtual size: 806KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 136KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 100KB - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 450KB - Virtual size: 450KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ