Behavioral task
behavioral1
Sample
4ed687e2d0c728c337322736e8d2036634487c8376d4ffac0ce9e9722c4c960c.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4ed687e2d0c728c337322736e8d2036634487c8376d4ffac0ce9e9722c4c960c.exe
Resource
win10v2004-20231025-en
General
-
Target
4ed687e2d0c728c337322736e8d2036634487c8376d4ffac0ce9e9722c4c960c
-
Size
972KB
-
MD5
ad4c9a5bda7c34d125498e49e1a999aa
-
SHA1
1c6a046b6e244773d290a3eff71cb2ce9dfdda94
-
SHA256
4ed687e2d0c728c337322736e8d2036634487c8376d4ffac0ce9e9722c4c960c
-
SHA512
a8a4538035c6cb6973af8e5b6b26552780908cac2e56399363a65c8b04d1c2d3b4feb11007a8cb3e7b38d0bcbc0843e00987fc11ebf0e5ee22d7f7e8523e95e3
-
SSDEEP
24576:sYDMhLwfyLCL3fZL80bz1hfTFuKiUR5Z3FuZ:s0BJZj3FY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ed687e2d0c728c337322736e8d2036634487c8376d4ffac0ce9e9722c4c960c
Files
-
4ed687e2d0c728c337322736e8d2036634487c8376d4ffac0ce9e9722c4c960c.exe windows:4 windows x86
cd753abe7b0e5cf29b4e0e4f9d3c5c51
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Module32Next
GlobalMemoryStatusEx
GetDiskFreeSpaceExA
CreateFileA
Process32First
Process32Next
VirtualAlloc
VirtualFree
GetCurrentProcessId
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateWaitableTimerA
SetWaitableTimer
CreateMutexA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetTickCount
lstrlenW
WideCharToMultiByte
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleFileNameA
FindNextFileA
FindFirstFileA
FindClose
WriteFile
GetStdHandle
GetCommandLineA
FreeLibrary
GetProcAddress
CreateToolhelp32Snapshot
LCMapStringA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
MultiByteToWideChar
SetFilePointer
RaiseException
IsBadWritePtr
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetLastError
TlsGetValue
SetLastError
GetVersion
GetFileAttributesA
LoadLibraryA
VirtualProtect
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedIncrement
InterlockedDecrement
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
user32
PostQuitMessage
MessageBoxA
wsprintfA
IsWindowVisible
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
CreateWindowStationA
GetAsyncKeyState
wvsprintfA
SendInput
FindWindowExA
GetParent
GetWindowTextLengthW
GetWindowTextW
PeekMessageA
OpenClipboard
EmptyClipboard
CloseClipboard
CreateDialogIndirectParamA
UpdateWindow
GetMessageA
SendMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
GetWindowTextLengthA
SetWindowTextA
GetDlgItem
ShowWindow
SetWindowLongA
GetWindowRect
ScreenToClient
SetWindowPos
GetWindowLongA
GetWindowInfo
shell32
ShellExecuteA
ws2_32
WSAStartup
closesocket
socket
htons
inet_addr
connect
gethostbyname
send
recv
getsockname
ntohs
WSAAsyncSelect
select
WSACleanup
Sections
.text Size: 296KB - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 656KB - Virtual size: 722KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ