Behavioral task
behavioral1
Sample
a102eebddd9c381a71f951eba1fd9740.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a102eebddd9c381a71f951eba1fd9740.exe
Resource
win10v2004-20231215-en
General
-
Target
a102eebddd9c381a71f951eba1fd9740.exe
-
Size
160KB
-
MD5
a102eebddd9c381a71f951eba1fd9740
-
SHA1
1a43ffca4703e6608328e480fd413ee71f700584
-
SHA256
65d711ed28275e10c50c6e40d92da022759602c67316b69709e6a3069459790f
-
SHA512
70f6accfb1b6debab5535b46c405a33e433b7d51cd93262b5950214195825f0759fc1e455d7999713c28a28a90fd3f885b36c784bf35e01de38ffaa9e8e3043b
-
SSDEEP
3072:8N7Ae3MA10ZaX2XMzdk23NLdXrVuY+i1HXLc:81fX2clNhbgQ4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a102eebddd9c381a71f951eba1fd9740.exe
Files
-
a102eebddd9c381a71f951eba1fd9740.exe.exe windows:4 windows x86 arch:x86
39ec59eab5d543786ffe198f2c52a54b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
modf
strrchr
srand
_ftol
rand
??3@YAXPAX@Z
_isctype
_strnicmp
strchr
malloc
sscanf
calloc
free
realloc
_vsnprintf
vsprintf
exit
vprintf
_strdup
_stricmp
__CxxFrameHandler
??2@YAPAXI@Z
toupper
strncmp
sprintf
kernel32
Process32First
Process32Next
CloseHandle
OpenProcess
TerminateProcess
CreateThread
Sleep
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
GetCurrentThreadId
HeapFree
GlobalAlloc
GlobalLock
RtlMoveMemory
CreateToolhelp32Snapshot
GlobalFree
MulDiv
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
SetEvent
ExitThread
CreateEventA
CreateSemaphoreA
WaitForSingleObject
GetExitCodeThread
TerminateThread
ReleaseSemaphore
DeleteCriticalSection
ReadProcessMemory
ExitProcess
HeapReAlloc
IsBadReadPtr
GetVersionExA
FormatMessageA
WriteFile
CreateFileA
GetTickCount
GetCommandLineA
RtlFillMemory
HeapAlloc
GetProcessHeap
GetModuleFileNameA
GetCurrentProcess
SetProcessWorkingSetSize
SetLastError
GetProcAddress
GetModuleHandleA
GlobalUnlock
gdi32
CreateFontA
BitBlt
CreateCompatibleDC
DeleteDC
GetDeviceCaps
CreateDCA
CreateSolidBrush
SetBkMode
SetTextColor
DeleteObject
GetStockObject
SelectObject
comctl32
ord17
InitCommonControlsEx
user32
GetParent
InvalidateRect
UpdateWindow
wsprintfA
ScreenToClient
MapWindowPoints
IsWindowVisible
SetWindowPos
CreateDialogParamA
SetWindowTextA
IsWindowEnabled
ShowWindow
GetWindowRect
GetDesktopWindow
DestroyWindow
DefWindowProcA
SetWindowLongA
GetWindowLongA
PostMessageA
GetClassLongA
CallNextHookEx
CreateDialogIndirectParamA
PostQuitMessage
IsDialogMessage
EndPaint
BeginPaint
SetMenu
IsWindow
UnregisterClassA
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
CopyIcon
LoadIconA
LoadBitmapA
GetDlgCtrlID
TrackMouseEvent
EnableWindow
GetDlgItem
TrackPopupMenu
GetCursorPos
ClientToScreen
SetFocus
GetWindowTextA
GetWindowTextLengthA
PeekMessageA
SetWindowsHookExA
UnhookWindowsHookEx
CreateWindowExA
CallWindowProcA
SendMessageA
GetActiveWindow
GetSysColor
MoveWindow
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
shell32
ExtractIconA
SHCreateDirectoryExA
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
shlwapi
PathFileExistsA
StrTrimA
ole32
CoInitialize
CoUninitialize
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
olepro32
ord251
oleaut32
VariantChangeType
VariantInit
SafeArrayGetElement
VarR8FromCy
VarR8FromBool
LoadTypeLi
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
HttpEndRequestA
InternetSetOptionA
InternetCrackUrlA
Sections
.text Size: 120KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE