Behavioral task
behavioral1
Sample
a13fac3f38ec4c216d19453c57c82f07892600d8ce379a31a2fb12405afeaa4b.exe
Resource
win7-20231020-en
General
-
Target
a13fac3f38ec4c216d19453c57c82f07892600d8ce379a31a2fb12405afeaa4b
-
Size
123KB
-
MD5
bd97c372d3f00d005ecbb01e35966af1
-
SHA1
921249b7b6da33e4c7777faf5b4190f31625859a
-
SHA256
a13fac3f38ec4c216d19453c57c82f07892600d8ce379a31a2fb12405afeaa4b
-
SHA512
b5390afde70d26c463e471c241df29aaae5785e7e0abf3637ad811aaf84e0085a97e2f228064bb8082b4e238146e83344011a6e55ac64c91b3d1ff70d3ffacb1
-
SSDEEP
1536:TfKdMAA8F2X677wNxM+ObMWqigulfWenewy2JuTHjrLsi9o6SUXijjjjjjjjjmOD:TidMAf2X60cBqDWOXwqHQUX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a13fac3f38ec4c216d19453c57c82f07892600d8ce379a31a2fb12405afeaa4b
Files
-
a13fac3f38ec4c216d19453c57c82f07892600d8ce379a31a2fb12405afeaa4b.exe windows:4 windows x86
e2ba5f743e2885d8ff6eb453d4babf89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
VirtualQueryEx
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
lstrcpynA
GetProcessHeap
GetModuleHandleA
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetCommandLineA
FreeLibrary
LCMapStringA
GetCurrentProcess
WTSGetActiveConsoleSessionId
RtlZeroMemory
lstrcpyn
lstrlenA
GetCurrentThread
GetEnvironmentVariableW
GetModuleFileNameW
CopyFileA
RtlMoveMemory
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
ExpandEnvironmentStringsW
user32
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
GetMessageA
DispatchMessageA
advapi32
DuplicateTokenEx
OpenProcessToken
CloseServiceHandle
StartServiceA
OpenServiceA
CreateServiceA
OpenSCManagerA
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
LookupPrivilegeValueA
shell32
ShellExecuteA
CommandLineToArgvW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
msvcrt
strncmp
free
malloc
sprintf
atoi
_ftol
modf
floor
strrchr
strchr
realloc
??3@YAXPAX@Z
memmove
__CxxFrameHandler
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE