Behavioral task
behavioral1
Sample
fd5f4652c143c57789a5a88eaad257a1cc831f7608d473adbdec7c096b6af797.exe
Resource
win7-20240221-en
General
-
Target
fd5f4652c143c57789a5a88eaad257a1cc831f7608d473adbdec7c096b6af797
-
Size
296KB
-
MD5
166cdba78c691fe94343e75d591cb246
-
SHA1
30c6edbf781c77cc8a3ccefe74b72eccbb916085
-
SHA256
fd5f4652c143c57789a5a88eaad257a1cc831f7608d473adbdec7c096b6af797
-
SHA512
0fcc04d87fbfcb1383bd7f6d440aac4e4ad3a4cfcd25a12c9db7de70cb86550fd9ec6034315cbfb9fe396d6a2c068f6ff8b18bc55bfa8628205252cdfb9639a1
-
SSDEEP
3072:XWGt5Ib2kw4UoXOWMGtI3baxjDLi5EViti1taqcCvUvLlHX2n7:XHIb2ktUoXpIraxjDem93aqsvLlGn7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd5f4652c143c57789a5a88eaad257a1cc831f7608d473adbdec7c096b6af797
Files
-
fd5f4652c143c57789a5a88eaad257a1cc831f7608d473adbdec7c096b6af797.exe windows:4 windows x86 arch:x86
4a83e6883fe624b38d13f2350864f14b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
GetTempPathW
GetCurrentProcess
OpenProcess
QueryDosDeviceW
lstrcpyn
RtlMoveMemory
RtlZeroMemory
VirtualQueryEx
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
lstrcpynA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
Module32First
ReadFile
Process32First
CreateFileA
GetEnvironmentVariableA
GetTickCount
GetCommandLineA
GetModuleFileNameA
FreeLibrary
LCMapStringA
IsBadCodePtr
SetUnhandledExceptionFilter
CloseHandle
IsBadReadPtr
Process32Next
FlushFileBuffers
SetStdHandle
CreateToolhelp32Snapshot
GetFileSize
LocalSize
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetVersionExA
HeapDestroy
HeapCreate
WriteFile
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
MultiByteToWideChar
user32
TranslateMessage
MessageBoxA
PeekMessageA
DispatchMessageA
wsprintfA
GetMessageA
shell32
ShellExecuteA
SHGetSpecialFolderPathW
CommandLineToArgvW
iphlpapi
GetIpForwardTable
psapi
GetProcessImageFileNameW
advapi32
AdjustTokenPrivileges
CreateProcessAsUserA
ws2_32
WSAStartup
oleaut32
VariantTimeToSystemTime
Sections
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE