Behavioral task
behavioral1
Sample
e752c4df0191087a2696ba1655c21ef87e63e0fa7da68fc9d15c7492e40bcb24.exe
Resource
win7-20230831-en
General
-
Target
e752c4df0191087a2696ba1655c21ef87e63e0fa7da68fc9d15c7492e40bcb24
-
Size
10.2MB
-
MD5
8f77a4913fd47babb8e513516b3acd65
-
SHA1
d688cad101a1ff33a868bc703dee9c897fc75841
-
SHA256
e752c4df0191087a2696ba1655c21ef87e63e0fa7da68fc9d15c7492e40bcb24
-
SHA512
e84ee3215e876d0d70e832aeb7bb0426f117683e85aa8df4b03b5b577e89f6198023ad76a4810675ed5d1bd2835dbe256011f430d78e6b6b142f9487778581a6
-
SSDEEP
196608:LgQABqozWmePhExR7rG6/NfNzaXaSPpyl1+SfTeyHUQHPetJ55wMm5+jaDD:HmUurG6FtUfPpoISvHx2tbq5+jaDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e752c4df0191087a2696ba1655c21ef87e63e0fa7da68fc9d15c7492e40bcb24
Files
-
e752c4df0191087a2696ba1655c21ef87e63e0fa7da68fc9d15c7492e40bcb24.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 616KB - Virtual size: 616KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE