Behavioral task
behavioral1
Sample
NEAS.4c6668201f429661e0c1248bb20d8a70.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.4c6668201f429661e0c1248bb20d8a70.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.4c6668201f429661e0c1248bb20d8a70.exe
-
Size
106KB
-
MD5
4c6668201f429661e0c1248bb20d8a70
-
SHA1
d7b9cd94e197ec880c9ef548c8699a534ef5cf94
-
SHA256
bb717847e840ced3f32b7dcbabc7938a3f7fe0b08bf48e2ccf45dd77a825c099
-
SHA512
e2e72d24cd150d1f7565c517319155e362b450c3a3eef3c36320793f0f8750b4e72885306ec720b6a19a9eb954791b123c7cedd8d41beab268c14e4ee594b333
-
SSDEEP
1536:DHPaisoc013lwRacN2zgrUzQ5lfuEAw45YyN6C9maUiDExdudVCSlixSpe15FOQJ:DP57c2zgwIuXHOpq64qA7M/y/O
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.4c6668201f429661e0c1248bb20d8a70.exe
Files
-
NEAS.4c6668201f429661e0c1248bb20d8a70.exe.exe windows:4 windows x86
1ca76329db205a6ccbbfd19605f042fd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
ExitProcess
IsBadReadPtr
CloseHandle
ReadFile
GetFileSize
CreateFileA
DeleteFileA
CopyFileA
MoveFileA
WriteFile
SetCurrentDirectoryA
GetCurrentDirectoryA
lstrlenW
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
HeapReAlloc
MultiByteToWideChar
lstrlenA
HeapDestroy
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
HeapFree
HeapAlloc
GetProcessHeap
GetTickCount
RtlMoveMemory
GetModuleFileNameA
SetFilePointer
GetModuleHandleA
user32
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
wsprintfA
MoveWindow
GetDlgItem
PostQuitMessage
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
SystemParametersInfoA
AdjustWindowRectEx
TrackMouseEvent
GetClientRect
GetSysColorBrush
GetSysColor
SetWindowLongA
SetWindowPos
ScreenToClient
PeekMessageA
SendMessageA
ShowWindow
DestroyWindow
DefWindowProcW
SetWindowLongW
RegisterClassExW
LoadCursorA
LoadIconA
MessageBoxA
AppendMenuA
CreateMenu
GetWindowRect
SetWindowTextA
DispatchMessageA
GetMessageA
UpdateWindow
CreateDialogIndirectParamA
shell32
DragQueryFileW
DragFinish
SHGetSpecialFolderPathA
gdi32
DeleteObject
SetTextColor
CreateSolidBrush
SetBkColor
SetBkMode
GetStockObject
msvcrt
_ftol
tolower
strncmp
atoi
atof
_atoi64
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_CIfmod
rand
srand
sprintf
strchr
modf
memmove
free
malloc
_strnicmp
__CxxFrameHandler
strrchr
shlwapi
PathFileExistsA
comdlg32
GetOpenFileNameA
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE