Behavioral task
behavioral1
Sample
51b56a5e6f2c4db0be784b2b37aaf1f3.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
51b56a5e6f2c4db0be784b2b37aaf1f3.exe
Resource
win10v2004-20231215-en
General
-
Target
51b56a5e6f2c4db0be784b2b37aaf1f3
-
Size
5.7MB
-
MD5
51b56a5e6f2c4db0be784b2b37aaf1f3
-
SHA1
8eec52ccd19d28798ee3595039765b5e191cd2f0
-
SHA256
db9c2d3e7cd3775c58404d8a871e04d56184a943dd5df7d5ecc4408ef744e320
-
SHA512
bf16369bada3873e8cf65c56c8773ead1544c18db73c81588e70a15fe6bc8b1e83aed334e2dde4db8271b939ec0dbf4c9ef2a33eed681d0699a471832021fd43
-
SSDEEP
98304:adE1OdE1udE1OdE1MdE1OdE1udE1OdE1edE1OdE1udE1OdE1MdE1OdE1udE1OdE1:OWaW6WaWAWaW6WaWqWaW6WaWAWaW6WaW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/out.upx family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 51b56a5e6f2c4db0be784b2b37aaf1f3 unpack001/out.upx
Files
-
51b56a5e6f2c4db0be784b2b37aaf1f3.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 456KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 238KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 296KB - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE