Behavioral task
behavioral1
Sample
878594dfc86e3486d003983708b5eb150ae35a158cc5f7bc0bd99631c1007ad9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
878594dfc86e3486d003983708b5eb150ae35a158cc5f7bc0bd99631c1007ad9.exe
Resource
win10v2004-20230915-en
General
-
Target
878594dfc86e3486d003983708b5eb150ae35a158cc5f7bc0bd99631c1007ad9
-
Size
154KB
-
MD5
9a6cc4c3ad89f95cbb0f1a3df9267ae5
-
SHA1
737fc848d1e2068a4ab9c7c03c569be6ce72a818
-
SHA256
878594dfc86e3486d003983708b5eb150ae35a158cc5f7bc0bd99631c1007ad9
-
SHA512
2a72cf193b1a1ae3b9a6ba5f4df3ec8572aeb6164452c53ef69fb1961daec52c258bd574f812f4c77ffeacb047fa89386a4254fc95acaa6dca18c01e2c749764
-
SSDEEP
1536:1mV4WaWNVPUTW6FViP6+1QrE2WrG/t3v24R+t6gz:1C4rWNVB4/Z/3v24R+t6gz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 878594dfc86e3486d003983708b5eb150ae35a158cc5f7bc0bd99631c1007ad9
Files
-
878594dfc86e3486d003983708b5eb150ae35a158cc5f7bc0bd99631c1007ad9.exe windows:4 windows x86
5fdb18d3bea12632a408ea4c5005ef00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
RtlMoveMemory
lstrcpyn
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersion
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
GetMessageA
PeekMessageA
advapi32
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ