Behavioral task
behavioral1
Sample
NEAS.befffb854b0ace081076f7b9648f0bc8exe_JC.exe
Resource
win7-20230831-en
General
-
Target
NEAS.befffb854b0ace081076f7b9648f0bc8exe_JC.exe
-
Size
3.4MB
-
MD5
befffb854b0ace081076f7b9648f0bc8
-
SHA1
2329d8d37af1e134cdbab1c903a9a4c107281f30
-
SHA256
378748d14aa9f7b8e23bec023a3ab3857fb8ebd31dba26cafebb3571846fa9e4
-
SHA512
3230457881f0dea7310fcbafc4b133d509a7faad4d9f65898c63ecffa00d500103eadf811b676b332f338ae03c1f5549d15e5e5daa9f43647170cc9617d4358b
-
SSDEEP
49152:2bY3XNvVJ9y9E9VJ9y9EIaK+JLeT/4MnYYJ2ZhqSGLHkJEMUo3iItboeisbPAaav:DVJy94Jy9oK+JLVIDQtav
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.befffb854b0ace081076f7b9648f0bc8exe_JC.exe
Files
-
NEAS.befffb854b0ace081076f7b9648f0bc8exe_JC.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 147KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE