Behavioral task
behavioral1
Sample
NEAS.56b1bdd891c91b0cab601817b61df640.exe
Resource
win7-20230831-en
General
-
Target
NEAS.56b1bdd891c91b0cab601817b61df640.exe
-
Size
436KB
-
MD5
56b1bdd891c91b0cab601817b61df640
-
SHA1
491fe28d1ff4d59e11bbecd2cc1efe8c92ea541b
-
SHA256
3f08af2d3d2e374899d8c1a5505f3d3c61460f51cbe4500782cb42f9e1ae5b22
-
SHA512
f53f4683cac3836cb0d0ae5041ba42c63e9f0a966db97724f7142ff67c284d2754b6adcd857f972c315af17ff3333a82b9894865164d0cf254f3f5c5e3b8fdee
-
SSDEEP
6144:dGdR+Yk/N8duBmG6t+UnRsRCQ/OJZOg7v:doR+Y4NSG6oUnRsdOJZOg7v
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.56b1bdd891c91b0cab601817b61df640.exe
Files
-
NEAS.56b1bdd891c91b0cab601817b61df640.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 391KB - Virtual size: 390KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE