v|E~�+ͤ�e ����U�捒W���2���w�����R�q��>G�ZsY�*���$H)'t�eA���7�����S����<�8�ӫn�9��빢��DJ7r�}7�r�}e��P�I�K�.��*���pK�7����j��_�s���uI�� yIΐn��|�+��@�PI��SS9Y�Oϝ���o����\J�+��I��J8G=���U�r18!J�J��q>�&�ᬂ��|PeI�ǃ�7����+R}T�vj����yQ7@��x�E��K���'����������=l�<0��͐1�q kfq���D����ƛ���J���`�W"�W�f^Yg���������\�����2G: ga�0A���,vo���6�����.�}���j���H�͉*� ���7�E������'��V~ ��7�Σ�:�����m�v�7j�#�*���5+/�yY�~�`�cJǑ���%k�bm@�X�B��`��R�Q%i���WZ ��1��\L�u6D�F���:ҺX��VnxM~�����_N.�cjN�x�C�H�I�\��V��-9�!��pmA���qxϒs�������^9���"�s�������bt��/@�(b z'J-���}�W���0�����sߣ���9�260.}U۾�M�; W�!��d�r#�\���ooI��CVcdg(�XlaJ�6��?U諫�6H���:>��>@����,)� ���Ȕ ��z���W�z ���<HX�J�b�m\y%&BTX� L�~/0��{libE/��T��Q��r�+�K����!�"r,s.�*���,��*+g�����U:��oh]>�{�����_���i�U�5cq�fdQH�� ��3����$&4 �t���{[�g�e6UۇMʺ���bW���0�����6[+g���$�s*����(~�\��f�*��M�D��.�@^H���d��R<|���È�+���$J�k�ir}s�k���7i���;�ѵ�#�Y��P /8�0�g"��Ȍ��&8�`ȣ��16Q�>��r�$x�]X�>P(��O�b�֛6�1�@Zw���pqx�ѹQX������,\Sh:ދΘa����7���н�����}�/7-�0�6�\��1�:l_�� ��2��~�9&kl�<��Y����l��f�Φ>��� �SpD�z����dT=ap5%"鶏�[J%4&O���x�)gQ$ї�-��� B��<\�VL�I�la��c-N��W ��Dj�5��s<%��Y�~��杬7J��E�~���ݩ�����b䀽����f�^��.͟5\IIs=q���җ��<m6>Z��>���i,�!�K�C��R��P7�O��Tom��5�c�]�J���+��`APڱ~I�A��Kh���4�Y��;�BP� ��_��ę���]�5��k>'�8�������; �G.�v�:{H$�eu_�h�*h^�l�Lѻ: ڽ��g�J�y�'�S���9�H��D����d�� ����n�� �q��1�vUQ���^w�X8p���0N<�5�ӿ�U���a�l�k�Ǘ��1���ÌY�-~h�{����p�'`��z V^����s��He��١��]݃އ�)�d��}���Q�_;<4��Z�r�0�'|�����������*��kߦ�� �7�(���,U�i���-#uir�X����9��x:͞��3ɟ92|���������f�6=�c��=-Ə�� �RFT�{��6H�LK�I�JQ9c��4)�j� �bg�#��,�v}�{��u�R��9<�i�S\���_��0�a^��0�Y�o�t�G9ڂF��.�J��կ5V�'�8���ύ5C[�&ƥ ����(F|*�U�g�-��im�m}&"IYJ�)�VM�+�R 2lRJɚc�մ���8�ꔖ��K9aq��u4���O��-��W�Zl#���� �����c�A�M�����U��q�X�����D�W_���ƣ�ۇ�u�����e�x �����q�N8{�����#C덾�)Vyg��0�Z����xI �${����;���k�A��xb����~:� �M�,P^�� J����L��=�9��@��� �hz�R֥^�I�o�%�^�12 �Ӷx�x���V��b\�����x)��qbOM�Ө��-�tb��Nӆ�jVW�k] �����'�Po0B�.(��@���� �-�y&����3D�]<}s�r��L�]��Iѹ��M����k>l�X�"hg�y.��A�����S`x����b*XcN���d6<ъpL�s�4L؛%�5��vnS�������4Ά�`6��c<��և�±�*�ڲ�N���ڟ»�{��;�(�}D��':UU�~=�������ݷ�����-�puu�̯=@p� #�/��2nA ��$Fs�Z�����u�xj��❺�X�_�n���E���+LF��3�ѧO�p�X��9������J|V�T�/�~��R/�qX�trJ���"dfČ��|9�5".��M�j���n��$dw���5ħ��n=��Ml�l��M���o�)�*�MmDY�B4Q�� �λ��~)%FT�f� �B����v(���s��u�������p�YPa��+�e�M?�{���j�<4)vs�e���'?��=�P_ G�U���Ns�3����E�I\�+�뛤d�@�Qv&W^��\M��uǺ��u�;ۥ-!v�\o��������wj�m��Fݢ [`��-�=��>ж���P��L���! ���F�����V��Q�\$�`��a�g��g�8��X� ����x�>T� �g��@Р�� �-(cPo^�g݁�v�Ix]M{��1*PT7���{;&�x�\+�v1?�YJ�xNt���r8m/ ^/�2et�'*$?A��� G�;J:Y(�}��]4fʒv�p�2B�%��J�����u�=O+������)�C�-=ʼ�ݎ��?3��7�NJA��s�99������qO�����*B��x�5�Y#쾐�G}��Gj��pE�y�����S�g2�p��%K�}!��
Behavioral task
behavioral1
Sample
82c6bdd23b82548092a80da440237cdfde1e7c194cfe79c9f38e3b3a772375a0.exe
Resource
win7-20230831-en
General
-
Target
82c6bdd23b82548092a80da440237cdfde1e7c194cfe79c9f38e3b3a772375a0
-
Size
11.5MB
-
MD5
e8257df22cfd356f3b0f491083e502b1
-
SHA1
b3e2ab3bb6b73671afba00699d3a3a6ca8c4ec7d
-
SHA256
82c6bdd23b82548092a80da440237cdfde1e7c194cfe79c9f38e3b3a772375a0
-
SHA512
8cea23dedfc6444ce232ee86d7cda9bcf91601484b0a4260ef95a2dbc621217ac3ab36aee63c16b86e4a016de147d34600baae3375a89433319ee208381214b1
-
SSDEEP
196608:gDSderaD8nD/0LZ6EM10zZ4MCq/NysPD8JA7HsZPG0th96VGl030P/YzyU5Sll0V:g0AD/0L5MI06PD8JA7UG2h9SGl03I/YJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82c6bdd23b82548092a80da440237cdfde1e7c194cfe79c9f38e3b3a772375a0
Files
-
82c6bdd23b82548092a80da440237cdfde1e7c194cfe79c9f38e3b3a772375a0.exe windows:5 windows x86
d8db078da568fe0dd1d4ecc9a6a3896c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetFocus
CharUpperBuffW
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 716KB - Virtual size: 712KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 417KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se0 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.se1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se2 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 196KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ