Behavioral task
behavioral1
Sample
0a7cf5715e1abd9620facc02eff14cbe6fb1206136e03d4e2add040b691e7301.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0a7cf5715e1abd9620facc02eff14cbe6fb1206136e03d4e2add040b691e7301.exe
Resource
win10v2004-20231127-en
General
-
Target
0a7cf5715e1abd9620facc02eff14cbe6fb1206136e03d4e2add040b691e7301
-
Size
12.0MB
-
MD5
2d690bf837b25318c52f23e5f8b6b069
-
SHA1
d9d039683bfeb3b0ba9a29a7ec9bb1940ed75ff6
-
SHA256
0a7cf5715e1abd9620facc02eff14cbe6fb1206136e03d4e2add040b691e7301
-
SHA512
2456eb1760dae1e25997f50e65def16136a293d5c91f98cb97acb8f2b18a801988364393af010d80742c50d9d68f0392b04c4ee165f743164dcfd17ab6edfaf5
-
SSDEEP
196608:Gx9epEKOq8T8N3M75YgVfG4fYsAh+qGAxUA2U+nPLuMo5V7vEQe:GxkENq4MMF/Vu4wsAh6OU7Umju17N
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a7cf5715e1abd9620facc02eff14cbe6fb1206136e03d4e2add040b691e7301
Files
-
0a7cf5715e1abd9620facc02eff14cbe6fb1206136e03d4e2add040b691e7301.exe windows:4 windows x86 arch:x86
84a0c7f80e341ebf05f3983675bc98b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryDosDeviceA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
DeleteFileA
FindNextFileA
FindFirstFileA
FindClose
GetModuleFileNameA
GetTickCount
WriteFile
CreateFileA
SetFileAttributesA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetLogicalDriveStringsA
ReadFile
GetFileSize
CopyFileA
MoveFileA
RemoveDirectoryA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
RtlMoveMemory
lstrcpyn
CreateDirectoryA
CloseHandle
GetSystemDirectoryA
GetTempPathA
OpenProcess
Sleep
GetCurrentProcessId
user32
PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
wsprintfA
GetMessageA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
shell32
ShellExecuteA
SHGetSpecialFolderPathA
psapi
GetProcessImageFileNameA
shlwapi
PathFileExistsA
PathFindExtensionA
PathFindFileNameA
msvcrt
_stricmp
floor
_CIfmod
sprintf
srand
rand
free
malloc
strrchr
_ftol
strchr
atoi
realloc
modf
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ