Behavioral task
behavioral1
Sample
93ed95e0252e9b1072070d4701381dc051ecf1108b8adb05823ea79de170d584.exe
Resource
win7-20230831-en
General
-
Target
93ed95e0252e9b1072070d4701381dc051ecf1108b8adb05823ea79de170d584
-
Size
1.4MB
-
MD5
4a2de75dad9acca1557d5534ee347d8f
-
SHA1
ed3604a98df26cc206fb53a233f6b9b11b7735e9
-
SHA256
93ed95e0252e9b1072070d4701381dc051ecf1108b8adb05823ea79de170d584
-
SHA512
bc994ee4bf9c11233b5f95d6ccdb08b4260c8bf5509d1394e9a0b57139ddb3513240a4eb27af91ed1e10281c20dba78c2331337a21101e67106ee845e88b8b2c
-
SSDEEP
24576:eEIpyeb/YPThXSZTjLodEJ9btgHOnB6hONUS1qjsXAKvWDEXsfkdlL:edBgbRSZsdMwHOB6hfSQAqDEkkH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93ed95e0252e9b1072070d4701381dc051ecf1108b8adb05823ea79de170d584
Files
-
93ed95e0252e9b1072070d4701381dc051ecf1108b8adb05823ea79de170d584.exe windows:4 windows x86
5edec866f83b092609ce1c4d586cd689
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
Process32Next
CreateDirectoryA
MoveFileA
CreateThread
RtlMoveMemory
GetTickCount
lstrlenW
WideCharToMultiByte
TerminateProcess
GetLastError
QueueUserAPC
TerminateThread
ResumeThread
WaitForSingleObject
SuspendThread
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
WriteFile
CreateFileA
GetModuleFileNameA
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
SetFileAttributesA
CreateProcessA
GetStartupInfoA
GetCommandLineA
FreeLibrary
GetProcAddress
CreateToolhelp32Snapshot
LCMapStringA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
CreateEventA
OpenEventA
FlushFileBuffers
CloseHandle
LocalFree
LocalAlloc
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
IsBadWritePtr
VirtualAlloc
TlsAlloc
TlsSetValue
OpenProcess
LoadLibraryA
GetCurrentProcess
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
RaiseException
user32
SetWindowPos
ShowWindowAsync
IsWindowVisible
GetWindowThreadProcessId
GetParent
GetClassNameA
GetWindowTextLengthW
GetWindowTextW
MsgWaitForMultipleObjects
GetWindowTextA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
IsWindow
SendMessageTimeoutA
PostMessageA
FindWindowA
SendMessageA
FindWindowExA
advapi32
GetTokenInformation
OpenProcessToken
winhttp
WinHttpCheckPlatform
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
WinHttpQueryHeaders
shlwapi
PathFileExistsA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Sections
.text Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE