blackmoon | 987140ae404b16fac686dbd22986dedc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

987140ae404b16fac686dbd22986dedc
Size

402KB
MD5

987140ae404b16fac686dbd22986dedc
SHA1

fc77b495c6b830b3f3b8791ace6ae6580b2df825
SHA256

391cd9178bfa27ad7cf932e321513139e32857743e6ec55b95fde225692a6752
SHA512

789c85d9229fd71c6eb9cf376e7dc507fbd75891d28fda2e5c72085fd6004fbb0ccb86ceb138b52de5b0005f23fe038fb0af89eb0160681ce5807ff45587eeca
SSDEEP

6144:/prbToBVOUYBES97W3C/7tnG3im6Z/JTG/Vw9C6qpMfvxlVL3YCWyfdBlbyq2b23:/prbUBVWF7ci1dpcMfbVLoCjpGqA2+uv

Score

10^/10

upx blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
static1/unpack002/out.upx	family_blackmoon

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/115网盘自动续期2.1/115网盘自动续期.EXE	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/115网盘自动续期2.1/115网盘自动续期.EXE
unpack002/out.upx

Files

987140ae404b16fac686dbd22986dedc
.rar
115网盘自动续期2.1/115网盘自动续期.EXE
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 476KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 222KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 158KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
115网盘自动续期2.1/What's New.txt
115网盘自动续期2.1/test.jpg
.jpg