Behavioral task
behavioral1
Sample
56c57fc924d5d37b2cc2d7d7bb0ddfef556cac968dec549875b7600daee67619.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
56c57fc924d5d37b2cc2d7d7bb0ddfef556cac968dec549875b7600daee67619.exe
Resource
win10v2004-20231020-en
General
-
Target
56c57fc924d5d37b2cc2d7d7bb0ddfef556cac968dec549875b7600daee67619
-
Size
156KB
-
MD5
2062b3f088fcdb1eee6f729707c9fa7c
-
SHA1
4df4ddc3cbc54b8a94f9359e09034ea223133202
-
SHA256
56c57fc924d5d37b2cc2d7d7bb0ddfef556cac968dec549875b7600daee67619
-
SHA512
515ea6f17e0905a60cbffebf7096314167bec1d642ee88fcebc2e819617b7c5c47d7dcfbf4f2c389aebefcc777142bb5a43e5ea57910791a22518c4677064354
-
SSDEEP
3072:EFrqDsvQTAstYDx8qN78SYqoZhtoUH8UHA:EFGD1DY1btGZf8e
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56c57fc924d5d37b2cc2d7d7bb0ddfef556cac968dec549875b7600daee67619
Files
-
56c57fc924d5d37b2cc2d7d7bb0ddfef556cac968dec549875b7600daee67619.exe windows:4 windows x86
83a55551dd2764b775994da513ba2157
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileA
CreateThread
RtlMoveMemory
GetTickCount
TerminateProcess
GetLastError
QueueUserAPC
TerminateThread
ResumeThread
WaitForSingleObject
SuspendThread
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
WriteFile
CreateFileA
GetModuleFileNameA
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
SetFileAttributesA
CreateProcessA
GetStartupInfoA
GetCommandLineA
FreeLibrary
CreateDirectoryA
LoadLibraryA
LCMapStringA
Process32Next
Process32First
FlushFileBuffers
CreateToolhelp32Snapshot
CreateEventA
OpenEventA
CloseHandle
LocalFree
LocalAlloc
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
IsBadWritePtr
VirtualAlloc
RaiseException
VirtualFree
OpenProcess
GetProcAddress
GetCurrentProcess
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
user32
MsgWaitForMultipleObjects
GetWindowTextA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
IsWindow
SendMessageTimeoutA
PostMessageA
SetWindowPos
FindWindowA
SendMessageA
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
GetTokenInformation
OpenProcessToken
winhttp
WinHttpCheckPlatform
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
WinHttpQueryHeaders
shlwapi
PathFileExistsA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Sections
.text Size: 112KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gs! Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.W:! Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ