Behavioral task
behavioral1
Sample
3b30acefd82122cd335ab7020344f353.exe
Resource
win7-20231215-en
General
-
Target
3b30acefd82122cd335ab7020344f353
-
Size
464KB
-
MD5
3b30acefd82122cd335ab7020344f353
-
SHA1
830ef2b5ccfde47c3358a20be4a4fca93e86f203
-
SHA256
8fa62edfc63672c097afc4bc2314b3545d2429f1940fac1332ba0aa51de50a94
-
SHA512
7f65faecee18bfe744727feb38831d0c4c73ab1b10e85407724cf687fb6ae38b048f091a19d7e0554b97ffba54e199e8d10365fb56868530d5e23b2ef6dc5c52
-
SSDEEP
12288:0q1we0tEafk8/0IWlfyB3GFrGWGssZge1+b:0q1we0tEM/0blfa3GFrGNssZg9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b30acefd82122cd335ab7020344f353
Files
-
3b30acefd82122cd335ab7020344f353.exe windows:4 windows x86 arch:x86
0cde94561b66cffc700ff7055ec6f4bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_ftol
strrchr
strncmp
strncpy
_strnicmp
kernel32
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
LocalSize
RtlMoveMemory
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
WaitForSingleObject
CloseHandle
GetEnvironmentVariableA
TerminateProcess
CreateToolhelp32Snapshot
Process32First
lstrlenA
Process32Next
OpenProcess
CreateWaitableTimerA
SetWaitableTimer
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
CreateFileA
GetCommandLineA
GetModuleFileNameA
lstrcpyn
user32
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
GetMessageA
PeekMessageA
shell32
SHGetSpecialFolderPathA
StrCmpNIA
ntdll
ZwUnmapViewOfSection
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 428KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE