Behavioral task
behavioral1
Sample
1eb8f6190af56f8f70fb46698b371c5054e799f299a660eac741b9c9dd64fed5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1eb8f6190af56f8f70fb46698b371c5054e799f299a660eac741b9c9dd64fed5.exe
Resource
win10v2004-20240221-en
General
-
Target
1eb8f6190af56f8f70fb46698b371c5054e799f299a660eac741b9c9dd64fed5
-
Size
220KB
-
MD5
1eb833e61ea323f792049ed29a2a9380
-
SHA1
2e3068e55a379e38a2a5de60454dde8a54f7b487
-
SHA256
1eb8f6190af56f8f70fb46698b371c5054e799f299a660eac741b9c9dd64fed5
-
SHA512
71f7824a9630f33452be66d495c3ad6a0770943e0892e5a4983446fd5b1c8cd11df4251d6bc6611596d598b752000fa46fe3aefa9020f7f433fb809d0d27a67e
-
SSDEEP
3072:2iRZRVd0OpnwlTbNgSlNDo7WHqrERcJv4OrsSMxteZ3gulgyZf6ZLut/EA:22O7fLoCHqoR2HrVyejWL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1eb8f6190af56f8f70fb46698b371c5054e799f299a660eac741b9c9dd64fed5
Files
-
1eb8f6190af56f8f70fb46698b371c5054e799f299a660eac741b9c9dd64fed5.exe windows:4 windows x86 arch:x86
fea2df910a26cec6913d2f2d76df5f4f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetModuleFileNameA
GetTickCount
GetUserDefaultLCID
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetModuleHandleA
GetProcessHeap
MoveFileA
CreateDirectoryA
InterlockedExchange
WideCharToMultiByte
GetLocaleInfoW
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetStdHandle
LCMapStringW
Sleep
FlushFileBuffers
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
HeapSize
SetUnhandledExceptionFilter
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
DeleteCriticalSection
GetFileType
GetStdHandle
MultiByteToWideChar
TerminateProcess
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
GetVersion
RtlUnwind
RaiseException
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
user32
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
PeekMessageA
GetMessageA
ole32
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CLSIDFromProgID
CoInitialize
oleaut32
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
wininet
InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
shlwapi
PathFileExistsA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 168KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE