�1��SP�4D��5��f#����渽zxiz��v�0�i9�W�{���r:������}R�:��0&�j��ںӼ'_�KI�R�F�����ԩ�������J<HLy�ށO�<�G ��|���W|��@d��Xc���@"��-�*�.���K�݅g��byjIؔ5]�ˏ;�:H ���Q�dì�W��c%z��h�^W���s��-��1F�����Z$�km��GeF�:���E+E$b�'��Z�.�HV�o�rVC��jht��@���0Tvd�_7���;C��{�ۖ%W .��g�FՔjEx��Y{����Y���<�x��JE'� h�"�# $]�0!*�5��v�\v�O���Սh�cPF���9Q�LZ��q)�>�/���RK��0fg1��W��~#w�H���~\��^��J�KG�\d�֡�@���>M���Q��"$��ݣ�/�0�6"�lV�Z���3F��\������C��� ����N�1r�7�7�cZɻ���F"������B�[G,��`�O�����Y,�9}-LƢ��fY��`��u#O���^ �� ��L P��u +��[�������a/u�^J���V�~��s�d������_��Y�:�su�#-{���2��EA�S2����U�����:ɐ�Bj��|�tӦZ?w"�tv� ��C���|��;�� �\[�q$O2@K�Kž6;����f|���6�����js}��[���/�����E�O~�*z�'l ��)<�pye�b�)Ә�ת�X�� \����$>6�������j�B����IrW�6����S!k�M�2�:�>�0���uЎFg xc}�숋}q�I�{39_&:Ւ(8��I��� �f˅W�#s���el).�� ��>L�l��d�ص�Ii�f4�q���CƿY�B��bC2 ��3�����Eno�"��*�g��2,:����[�ٿ��䯇�ϟr?1��U�� ['�梖��A$D6�ւ� ���/�Ъ<�������oq�B����e��� a���{�j e`^Zt���W*h5����8G��<E�_I"�=a���JJ;�"���e{��BW�5��|6���!�- �$ ?���~�CjS�V�o�Va��z���p(�$����H�ܿD�T�P��s4�o��J�m"[L�����M�t��F�O�D�A'Re(��!R$�h�B A���G�џ�YO�U�R��[��w6ӏ�)nm�\چ79,�6����ݧG%��ݨ\�|6+4��DPA����kIDzf1!0;%c��^I�c=1~ǒSt��mP JL��%��!��.�|��m_$�\a}Y]�Mq��ƨ�b��Ƶ�c�����F�:d������$�#�5��a�D7���ޓ���h�D�P�'������p;J,1x2\��9����[G>�YhD��@a��y��C�Z����Ѯ�43t����)P��XR�,K��m�8��O(�[��u$���v���K����~;l�N�*�a���J�E��o���������� q��˦��JK��x��85� y���#�M�t��4��岽z٨��3i]|3oB�#�5������_C�0�!tYç�/JTA+��5샔q�~�����w�汴'7�rޅ��ٓ����ΉR����@��Vx���n��@� ��c��,R�,'�h���A�Ĥ8Cb>`�xi,{u�gcA��L(�?k�Ę� �H �/�G�l��ѧǤ���ng�l<��)ɍT�B�k�sAYKK�M�����O>B@�4����8��~,����T����a�������`�~{��n�������{�B�����5%5S�#��&��z�]���0���jJF�5��O����$��Rh��VlY���sw1~��L��fٍцG���_>߽1bZFt�d�����A&���"�Wf�[�O�R=v�y��=S��ق���`Hlh��?�i{��R��"~����c��3�j�d�+C���{�'b`�gW��'���{�#3�{C�T{���aB��YK�o�r �ٴ;^*Y�<�����#�֩e[缲��?i�C�F���d��4 3��)��߲�7�l$�Ւ�{y��$5u{K�m"�o��x���\�3nx�י�L��z��A���%%S=����}����{��k��o�P�/��P�"X3bf��ؔ+C�� `x�U�{��D?I`���mV�+���o�S�OL�J�v��Y�r̵G�9�Z�%���˟� 98Oϵ��b�n������D`��OS� )��r��?�4Yo{�(W�$m�e@��X�����v_ۆ"���,��ʊ4��jK��/<0������>+uO�\cr��rj,�l6��MD��ɝ_�#�N��D�J}�Xb����^_и����?��_'�o��[�/� dR��=)� �j:�4v�d����e����l��X!�����Y��UZ���[`��t��U���*���d��Br;����<�F�!���"�3�!��Jo��B%.{ ���͘������뗘��Z��\�A���9�=X.2,6&^���.G��;�❚�Qꢶ_2��_�%�EX�Z�������ܧ3宑s&���O?���X���K Ԯdz��rXv+,��@N�� Է���5��TkRD�#p{_�h�g:"3�U�頻��3��/f#��IT����&��ed�d��=|�����~�����N�B�Z�1�P� �:�؊�㨂�1(a��&i�3Ƌ3��|Z�+���O�p��_�7���Z:%P��*� �0��1�{������l���^�zn�*8�GFp��O�_�b��*$U���N'�p'�ĴqV��ކ8�@.;ɘ,_����Ի� ���]tKB�U��N��f����Z6 �0v��a��Q7�)ѱ��+��_�������q,[�+d���j ��T���W�!i�>M��<��I;^����N����ՎP����������~��7L��E�A��?"���u��ZE�=k���.u��\1�٢�_��smӘK2?_Ķ֪ 7
Behavioral task
behavioral1
Sample
NEAS.4e4fa6d1fcdcbbd516bd4e80b5c819dd24118bd3b9443851c50cbf469d7823dd_JC.exe
Resource
win7-20230831-en
General
-
Target
NEAS.4e4fa6d1fcdcbbd516bd4e80b5c819dd24118bd3b9443851c50cbf469d7823dd_JC.exe
-
Size
11.5MB
-
MD5
b00fb53050080f64a3f6fbd15f9ad4bf
-
SHA1
9b833bf00eb7eb54572b44518ed4345ae2ade9ee
-
SHA256
4e4fa6d1fcdcbbd516bd4e80b5c819dd24118bd3b9443851c50cbf469d7823dd
-
SHA512
4008f7bd151ce985b06ac2789dcbedac30e7aab253510117e328e50b389e7084c57f3e227cce5d8d4ef920ae96490753085bb8d5c96bf960394e8f96f1474165
-
SSDEEP
196608:lfm1BTlBmvXeSOJW0QgOtGvu3qIwiVBMzEm2chgqMJUCelFdgWnRb4YwjbARPnwV:aZBuep2CviDvVBMg/QgqMUNlFdDnRIjb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.4e4fa6d1fcdcbbd516bd4e80b5c819dd24118bd3b9443851c50cbf469d7823dd_JC.exe
Files
-
NEAS.4e4fa6d1fcdcbbd516bd4e80b5c819dd24118bd3b9443851c50cbf469d7823dd_JC.exe.exe windows:5 windows x86
bac34b7e6ce2a91a93ee0891fbe747e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutUnprepareHeader
ws2_32
ntohl
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
CharUpperBuffW
gdi32
GetBkMode
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
InitializeSecurityDescriptor
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantCopy
comctl32
ord17
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 424KB - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 132KB - Virtual size: 487KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se0 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.se1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se2 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 360KB - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ