Behavioral task
behavioral1
Sample
9496fe8c94e0e46b319298bd694ca8eb75de703098f3f011c2cd5b38404a7021.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
9496fe8c94e0e46b319298bd694ca8eb75de703098f3f011c2cd5b38404a7021.exe
Resource
win10v2004-20231130-en
General
-
Target
9496fe8c94e0e46b319298bd694ca8eb75de703098f3f011c2cd5b38404a7021
-
Size
12.0MB
-
MD5
3e2f96fcd862fa6fd547e74899811f32
-
SHA1
bbc890f22e474fbf2ac994b9a4c124de6a1b87e7
-
SHA256
9496fe8c94e0e46b319298bd694ca8eb75de703098f3f011c2cd5b38404a7021
-
SHA512
037114d56c2c115609ec998f04519af907b17607d7bbabf54c9db2b0f5a3b610b3f9667787940bf9940cac3d3a5cce83c2c131974f5b1e24f43ff5882ba311eb
-
SSDEEP
196608:Gx9epEKOq8T8N3M75YgVfG4fYsAh+qGAxUA2U+nPLuMo5V7vEQe:GxkENq4MMF/Vu4wsAh6OU7Umju17N
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9496fe8c94e0e46b319298bd694ca8eb75de703098f3f011c2cd5b38404a7021
Files
-
9496fe8c94e0e46b319298bd694ca8eb75de703098f3f011c2cd5b38404a7021.exe windows:4 windows x86 arch:x86
84a0c7f80e341ebf05f3983675bc98b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryDosDeviceA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
DeleteFileA
FindNextFileA
FindFirstFileA
FindClose
GetModuleFileNameA
GetTickCount
WriteFile
CreateFileA
SetFileAttributesA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetLogicalDriveStringsA
ReadFile
GetFileSize
CopyFileA
MoveFileA
RemoveDirectoryA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
RtlMoveMemory
lstrcpyn
CreateDirectoryA
CloseHandle
GetSystemDirectoryA
GetTempPathA
OpenProcess
Sleep
GetCurrentProcessId
user32
PeekMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
wsprintfA
GetMessageA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
shell32
ShellExecuteA
SHGetSpecialFolderPathA
psapi
GetProcessImageFileNameA
shlwapi
PathFileExistsA
PathFindExtensionA
PathFindFileNameA
msvcrt
_stricmp
floor
_CIfmod
sprintf
srand
rand
free
malloc
strrchr
_ftol
strchr
atoi
realloc
modf
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ