Behavioral task
behavioral1
Sample
NEAS.9cf6ba0cad07d94777e553168cf47160.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.9cf6ba0cad07d94777e553168cf47160.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.9cf6ba0cad07d94777e553168cf47160.exe
-
Size
440KB
-
MD5
9cf6ba0cad07d94777e553168cf47160
-
SHA1
f09ebc90d01c8ab2123d83790cae1e83b8cdbc96
-
SHA256
87769516b528a64f9bc300531a90e46bce436acded1e756f6221b3063ec70fbb
-
SHA512
a435d34b0b78091889b57400ad2029e9bb5c49eba964326d8eabf714eae25adce22d2e7d3cb63ca074492cf505305ee28036f8820c15b0186de19de06cff56ec
-
SSDEEP
6144:SSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkhrP1DA:S2SHl+gv5gY1b5Eo4+EsEEIkhrP1DA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.9cf6ba0cad07d94777e553168cf47160.exe
Files
-
NEAS.9cf6ba0cad07d94777e553168cf47160.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 352KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 78KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE