Behavioral task
behavioral1
Sample
0f07b2dad9030c92d7685402060320eb264bbeb0579148b17a3638241987d27a.exe
Resource
win7-20230831-en
General
-
Target
0f07b2dad9030c92d7685402060320eb264bbeb0579148b17a3638241987d27a
-
Size
1.4MB
-
MD5
65e0aa29f37801667aa1a3b6e109053f
-
SHA1
3e3cf8761a5bc5b2683974666f7170b06a45f666
-
SHA256
0f07b2dad9030c92d7685402060320eb264bbeb0579148b17a3638241987d27a
-
SHA512
ea33816745eabc800ec9a90e0bce4033f30fb2eb93ef45a55f60b02e65f0fa49cb252bd741b55a8b7b2a8682c0e0ffaa188827edb59daff468e8299030c413b3
-
SSDEEP
24576:w6HnuUIlX2BVYAVCCN1cXrDDj/5AVrxSjX94BUdT6PMr/I4GnII5nodlf:wCOV2nY2CCjcbD/h5COR6Po/IlII5ob
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f07b2dad9030c92d7685402060320eb264bbeb0579148b17a3638241987d27a
Files
-
0f07b2dad9030c92d7685402060320eb264bbeb0579148b17a3638241987d27a.exe windows:4 windows x86
5edec866f83b092609ce1c4d586cd689
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
Process32Next
CreateDirectoryA
MoveFileA
CreateThread
RtlMoveMemory
GetTickCount
lstrlenW
WideCharToMultiByte
TerminateProcess
GetLastError
QueueUserAPC
TerminateThread
ResumeThread
WaitForSingleObject
SuspendThread
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
WriteFile
CreateFileA
GetModuleFileNameA
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
SetFileAttributesA
CreateProcessA
GetStartupInfoA
GetCommandLineA
FreeLibrary
GetProcAddress
CreateToolhelp32Snapshot
LCMapStringA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
CreateEventA
OpenEventA
FlushFileBuffers
CloseHandle
LocalFree
LocalAlloc
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
IsBadWritePtr
VirtualAlloc
TlsAlloc
TlsSetValue
OpenProcess
LoadLibraryA
GetCurrentProcess
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
RaiseException
user32
SetWindowPos
ShowWindowAsync
IsWindowVisible
GetWindowThreadProcessId
GetParent
GetClassNameA
GetWindowTextLengthW
GetWindowTextW
MsgWaitForMultipleObjects
GetWindowTextA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
IsWindow
SendMessageTimeoutA
PostMessageA
FindWindowA
SendMessageA
FindWindowExA
advapi32
GetTokenInformation
OpenProcessToken
winhttp
WinHttpCheckPlatform
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
WinHttpQueryHeaders
shlwapi
PathFileExistsA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Sections
.text Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ