Behavioral task
behavioral1
Sample
5959f6dea4d9319e7caf179a8dac37486974bee5295003789da0ce279e252113.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
5959f6dea4d9319e7caf179a8dac37486974bee5295003789da0ce279e252113.exe
Resource
win10v2004-20231023-en
General
-
Target
5959f6dea4d9319e7caf179a8dac37486974bee5295003789da0ce279e252113
-
Size
174KB
-
MD5
fdf1bf1f97566c90a32804b1a0530dc4
-
SHA1
9316c07f4c5036783f57e56716d39dab8afce2bf
-
SHA256
5959f6dea4d9319e7caf179a8dac37486974bee5295003789da0ce279e252113
-
SHA512
ab79f4bf92d5698bf49b6fefdb52f1c3d1e755f69e77a3120550cd5644bbc1233f54d3e375f645b4fa199c57374338a2eaaacc0444b40a9ebcfd30a1bd0c7b65
-
SSDEEP
1536:1mV4WaWNVPUTW6FViP6+1QrE2WrG/t3v24R+t6gz:1C4rWNVB4/Z/3v24R+t6gz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5959f6dea4d9319e7caf179a8dac37486974bee5295003789da0ce279e252113
Files
-
5959f6dea4d9319e7caf179a8dac37486974bee5295003789da0ce279e252113.exe windows:4 windows x86
5fdb18d3bea12632a408ea4c5005ef00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
RtlMoveMemory
lstrcpyn
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersion
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
GetMessageA
PeekMessageA
advapi32
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ