Behavioral task
behavioral1
Sample
55e5cb127ecf5d4b2ab08e245009377f.exe
Resource
win7-20231215-en
General
-
Target
55e5cb127ecf5d4b2ab08e245009377f
-
Size
380KB
-
MD5
55e5cb127ecf5d4b2ab08e245009377f
-
SHA1
ab34a052e5d3d915b01cef30a03805cc8ea4698a
-
SHA256
a2afc11fd15b92a8edb56d7877445549c3311d71cf18ce409244508d283131df
-
SHA512
c6f9a8a68f59d6396cee24f4ee4a0c2dc5fd33063056383524971db7792d04fdc758df5db6c6a27e5e308b3d0edc9efdea216bfd634e696cd31c237ae66c15ea
-
SSDEEP
3072:J+qSe5OmiEoAcCbZ6UzGIoutw+qSe5OmiEoAcCbZ6UKGIout:sqzOPI16UzHoS/qzOPI16UKHoS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55e5cb127ecf5d4b2ab08e245009377f
Files
-
55e5cb127ecf5d4b2ab08e245009377f.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tkjdelw Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE