Behavioral task
behavioral1
Sample
1a9a13daade17f796e7f091df71a45502b2b59f7d020996591b3652d187cc2b3.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1a9a13daade17f796e7f091df71a45502b2b59f7d020996591b3652d187cc2b3.exe
Resource
win10v2004-20231020-en
General
-
Target
1a9a13daade17f796e7f091df71a45502b2b59f7d020996591b3652d187cc2b3
-
Size
124KB
-
MD5
26079e48d01bef27e59bf748ede5c9d0
-
SHA1
9136cb722dba881f38d8cbb4fa3756c96e8731e4
-
SHA256
1a9a13daade17f796e7f091df71a45502b2b59f7d020996591b3652d187cc2b3
-
SHA512
1361e4f78851add7c2caab9edcbb967bf7bb4773c30aca509afad274efd751b47bb189ffad10ccd9f5a9dd12e894ce23eb9d3118f512c268e506f2aca4e55526
-
SSDEEP
1536:1mV4WaWNVPUTW6FViP6+1QrE2WrG/t3v24R+t6gz:1C4rWNVB4/Z/3v24R+t6gz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a9a13daade17f796e7f091df71a45502b2b59f7d020996591b3652d187cc2b3
Files
-
1a9a13daade17f796e7f091df71a45502b2b59f7d020996591b3652d187cc2b3.exe windows:4 windows x86
5fdb18d3bea12632a408ea4c5005ef00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
RtlMoveMemory
lstrcpyn
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersion
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
GetMessageA
PeekMessageA
advapi32
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ