Behavioral task
behavioral1
Sample
b415d8f888a9a3873e2146eb91a7f0d0657d0e439cd5c5f9070ea02a9d0e5294.exe
Resource
win7-20230831-en
General
-
Target
b415d8f888a9a3873e2146eb91a7f0d0657d0e439cd5c5f9070ea02a9d0e5294
-
Size
5.5MB
-
MD5
cca925933be5839a0a53f38fa857a025
-
SHA1
925432c489e03cf537b74fb24ce2f8441b525277
-
SHA256
b415d8f888a9a3873e2146eb91a7f0d0657d0e439cd5c5f9070ea02a9d0e5294
-
SHA512
039d5df3401698dcbc3aba28fbd6c38550fc7144aa4c237c4525ed9eb356f91e1ecac060f3125a1ede2d34b71791161ea7591aeb16039835f698e0067e24af5b
-
SSDEEP
98304:nLXwbTaMkxkeyaiVWd3BAoAC/9+D8bjC7w5KmA8vYn1FSWp65NlDTZ7Q:nTwbTGubakm1x9+objC85KmA86LEl7Q
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b415d8f888a9a3873e2146eb91a7f0d0657d0e439cd5c5f9070ea02a9d0e5294
Files
-
b415d8f888a9a3873e2146eb91a7f0d0657d0e439cd5c5f9070ea02a9d0e5294.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 464B - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE