Behavioral task
behavioral1
Sample
923e9bc28bd35953b11c0ab0171ce16436032f99821881734864975542bf9269.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
923e9bc28bd35953b11c0ab0171ce16436032f99821881734864975542bf9269.exe
Resource
win10v2004-20231020-en
General
-
Target
923e9bc28bd35953b11c0ab0171ce16436032f99821881734864975542bf9269
-
Size
324KB
-
MD5
f4537f4fb96883faaa1a56c32f991a79
-
SHA1
4d33190ee7995f3709542ca6b848f498ef3390c8
-
SHA256
923e9bc28bd35953b11c0ab0171ce16436032f99821881734864975542bf9269
-
SHA512
4ccac42b1c44896a11da81f87bef2859069bef1ec23dbce5fa4cb5df8b969604eebb8daf9616e212d334c63888e92eb99a6f671f5380170fdc0b4aea1b09b3cf
-
SSDEEP
6144:n5hc8NHPel4QjOv2gZuhTsGrYy2s4XiflkJc:n5hc83QavHuhTshPskC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 923e9bc28bd35953b11c0ab0171ce16436032f99821881734864975542bf9269
Files
-
923e9bc28bd35953b11c0ab0171ce16436032f99821881734864975542bf9269.exe windows:4 windows x86
ec9950caea7e0011585683524a165486
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
kernel32
LCMapStringA
LoadLibraryA
FreeLibrary
GetCommandLineA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
WideCharToMultiByte
GetFileSize
ReadFile
DeleteFileA
Sleep
GetLocalTime
CreateFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteFile
SetFilePointer
GetLastError
GetCurrentProcess
GetVersionExA
GetDriveTypeA
TerminateProcess
OpenProcess
GlobalMemoryStatus
lstrcpyA
lstrlenA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
GetTimeZoneInformation
GetVersion
SetSystemPowerState
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GetTickCount
InterlockedIncrement
InterlockedDecrement
MulDiv
LocalFree
FlushFileBuffers
lstrcpynA
GetFullPathNameA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CopyFileA
CreateDirectoryA
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
MultiByteToWideChar
GetDiskFreeSpaceExA
CloseHandle
GetProcAddress
SetProcessAffinityMask
user32
SendDlgItemMessageA
IsDialogMessageA
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
UpdateWindow
SystemParametersInfoA
GetDC
ReleaseDC
FindWindowA
GetWindowThreadProcessId
GetClassNameA
IsWindow
SendMessageA
GetWindowRect
GetSystemMetrics
GetMenuItemCount
SetWindowTextA
GetDlgCtrlID
EndDialog
CreateDialogIndirectParamA
DestroyWindow
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
SetCursor
PostMessageA
PostQuitMessage
ExitWindowsEx
SetForegroundWindow
SetActiveWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
EnableWindow
GetParent
GetWindow
PtInRect
IsWindowVisible
GetWindowLongA
GetWindowTextA
GetCursorPos
SetWindowLongA
GetDlgItem
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
CopyRect
ShowWindow
gdi32
CreateBitmap
RestoreDC
GetDeviceCaps
SelectObject
DeleteDC
GetObjectA
GetStockObject
SaveDC
DeleteObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
ole32
CoUninitialize
CoInitialize
OleInitialize
OleUninitialize
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
OleRun
OleIsCurrentClipboard
CoCreateInstance
OleFlushClipboard
CLSIDFromString
CoFreeUnusedLibraries
oledlg
ord8
oleaut32
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VariantInit
SafeArrayGetDim
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
advapi32
OpenProcessToken
RegOpenKeyExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
shell32
SHChangeNotify
ShellExecuteA
SHGetSpecialFolderPathA
comctl32
ord17
Sections
.text Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 124KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 772B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ