Behavioral task
behavioral1
Sample
dfb8a5fa6a5f78d241ce05393eda0b1c5bba37d7243b0786b5d3eb553137283d.exe
Resource
win7-20240221-en
General
-
Target
dfb8a5fa6a5f78d241ce05393eda0b1c5bba37d7243b0786b5d3eb553137283d
-
Size
172KB
-
MD5
eae0b47cde0242afddc006e02a244d37
-
SHA1
faba7a09bc44ccf2495653e4873f15f4c1ff97eb
-
SHA256
dfb8a5fa6a5f78d241ce05393eda0b1c5bba37d7243b0786b5d3eb553137283d
-
SHA512
f2a1b016ace58742093fcbe0732f741f9986caba11876ab863e21b7f9b71dd7bba854a614d4453e1061a299b78592131b39be405d9f08f4aa92a4b6c7be1a189
-
SSDEEP
1536:eNH42DGWp13tw1hVT/VgRRWHmNFiGrX066doxz9BLv+pLZpIGj5tdrrrqU:eNHrDGqjw1hIoSB6dOzEtpIGhr3N
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfb8a5fa6a5f78d241ce05393eda0b1c5bba37d7243b0786b5d3eb553137283d
Files
-
dfb8a5fa6a5f78d241ce05393eda0b1c5bba37d7243b0786b5d3eb553137283d.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 116KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ