Behavioral task
behavioral1
Sample
ae6ff1a63fdad667ddabac30e7ed53f4828b82c44afe546bcb2687b519e2b4ec.exe
Resource
win7-20230831-en
General
-
Target
ae6ff1a63fdad667ddabac30e7ed53f4828b82c44afe546bcb2687b519e2b4ec
-
Size
127KB
-
MD5
dffd46e5b56b8da245ded85852af5d06
-
SHA1
3a8ab750035979632f6000a36452159b0b34404d
-
SHA256
ae6ff1a63fdad667ddabac30e7ed53f4828b82c44afe546bcb2687b519e2b4ec
-
SHA512
82ea544029c0b32eb99e1353c540acd7aba585972b290185e704046bfa2c92d6dc461e65a8462ac0ef88e35f225c012c5fa2220f6f32df95be7ef6cf4d0d3504
-
SSDEEP
1536:6/mr9GZpKfovb7HMyDk05VW6bcdEAVxodT44qe3q1Ycvvr5kKEY7EFnzUf:6+9cGYX586bcdpyqewTvDyRxzUf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae6ff1a63fdad667ddabac30e7ed53f4828b82c44afe546bcb2687b519e2b4ec
Files
-
ae6ff1a63fdad667ddabac30e7ed53f4828b82c44afe546bcb2687b519e2b4ec.exe windows:4 windows x86
2307b7de7750c9846e06ec23b6a39669
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
VirtualQueryEx
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
lstrcpynA
CreateThread
GetProcessHeap
GetModuleHandleA
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetTickCount
GetCommandLineA
FreeLibrary
LCMapStringA
GetCurrentProcess
lstrcpyn
RtlZeroMemory
lstrlenA
GetCurrentThread
GetEnvironmentVariableW
GetModuleFileNameW
ProcessIdToSessionId
CopyFileA
RtlMoveMemory
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
WTSGetActiveConsoleSessionId
ExitProcess
user32
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
wsprintfA
advapi32
DuplicateTokenEx
OpenProcessToken
StartServiceA
ChangeServiceConfig2A
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
LookupPrivilegeValueA
shell32
ShellExecuteA
CommandLineToArgvW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
msvcrt
__CxxFrameHandler
calloc
free
malloc
sprintf
atoi
_ftol
rand
modf
floor
strrchr
strchr
realloc
??3@YAXPAX@Z
memmove
strncmp
ws2_32
WSACleanup
gethostbyname
WSAStartup
inet_ntoa
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE