Behavioral task
behavioral1
Sample
22abc706c246790e6ee03c4aa8ad565c5d15f867e3295cdf1ae1fed44e3eaab2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
22abc706c246790e6ee03c4aa8ad565c5d15f867e3295cdf1ae1fed44e3eaab2.exe
Resource
win10v2004-20231215-en
General
-
Target
22abc706c246790e6ee03c4aa8ad565c5d15f867e3295cdf1ae1fed44e3eaab2
-
Size
564KB
-
MD5
ed8859c1dcfbbbcb8eccf0d5175fbf5d
-
SHA1
48a9e3ad637e72a396d6cb0e10be31f4bfa50354
-
SHA256
22abc706c246790e6ee03c4aa8ad565c5d15f867e3295cdf1ae1fed44e3eaab2
-
SHA512
a8fc0cac37061ac065d66bf82005decf8194dc8c42b2b7a6a3e662a73fc41da61d4254eb9b4dd10fcdd29a6376aa0ff436c098bec7c98a8e51d82687d734055f
-
SSDEEP
12288:QFKnSYMBMMMMNMMMMZMMMM9MMMMTMMMM+MMMMPMMMDMMMMWMMMM9MMMMXMMMpMMa:QFKSYMBMMMMNMMMMZMMMM9MMMMTMMMM+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22abc706c246790e6ee03c4aa8ad565c5d15f867e3295cdf1ae1fed44e3eaab2
Files
-
22abc706c246790e6ee03c4aa8ad565c5d15f867e3295cdf1ae1fed44e3eaab2.exe windows:4 windows x86 arch:x86
c1dd1b0f7bf513ebac60cd5ca9a13675
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
MoveFileA
CreatePipe
WriteFile
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
PeekNamedPipe
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetStdHandle
CopyFileA
FindFirstFileA
FindClose
CreateFileA
SetFilePointer
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
CloseHandle
LCMapStringA
SetConsoleCursorPosition
ReadFile
FindNextFileA
SetConsoleTitleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetTickCount
msvcrt
__CxxFrameHandler
memmove
putchar
printf
strstr
_getch
strncmp
modf
realloc
strchr
strrchr
strncpy
??3@YAXPAX@Z
_ftol
atoi
sprintf
??2@YAPAXI@Z
free
malloc
_strdup
user32
PeekMessageA
GetMessageA
TranslateMessage
wsprintfA
DispatchMessageA
MessageBoxA
shlwapi
PathFileExistsA
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 231KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 300KB - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE