Behavioral task
behavioral1
Sample
NEAS.d947272f3034e4dc5c6b082132a9fc40_JC.exe
Resource
win7-20231023-en
General
-
Target
NEAS.d947272f3034e4dc5c6b082132a9fc40_JC.exe
-
Size
432KB
-
MD5
d947272f3034e4dc5c6b082132a9fc40
-
SHA1
a6894cc7cd0c8c76b6d725d6498daab77fde322f
-
SHA256
f348bc4b4d20e0c0534a89d36133a52293186cc7d46e0ba598e6f0b01083a881
-
SHA512
82e5f430a561b1140afb9709cbac9e9ce8672425d5c5f267b2afa6dbd8b9ffeabb96f0cbc7d78e6556ecbd522baf20a9368fe8acd28014be3e398a355b3d7402
-
SSDEEP
6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAT:c4Fm3b7yOAHNar4mUf9lJ82scqAT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.d947272f3034e4dc5c6b082132a9fc40_JC.exe
Files
-
NEAS.d947272f3034e4dc5c6b082132a9fc40_JC.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 387KB - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE