Behavioral task
behavioral1
Sample
56aecc8bb9986933c2f1b4d4146bd6cc.exe
Resource
win7-20231215-en
General
-
Target
56aecc8bb9986933c2f1b4d4146bd6cc
-
Size
1.2MB
-
MD5
56aecc8bb9986933c2f1b4d4146bd6cc
-
SHA1
25f643f0d551f315d7a3f1372e5ca5418fb52af1
-
SHA256
791b752a7bd8706faf6248e0dde6efee47ac3adc8826d8c080991abc647fc04c
-
SHA512
7749188fa0fbefc8a31ee262158a940b07cb417c7f015a72ebfb9c9b504fd814887405b071d56e5fadb65e8e9f55cd644e6bbaefea4b97358150135a54d449cb
-
SSDEEP
24576:vBsDyuX5UCS4lny4mCN946FnMtk9RsVb+s2H3U0MrNHs+Uv:vG1Xw4ZFmCrnMaYb+THBwBs+U
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56aecc8bb9986933c2f1b4d4146bd6cc
Files
-
56aecc8bb9986933c2f1b4d4146bd6cc.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
&hy0 Size: 908KB - Virtual size: 908KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
&hy1 Size: 344KB - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
&hy2 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE