Behavioral task
behavioral1
Sample
4809d30a0cc46e3f91ed3f5a77cdc884f312e8b30b9597cb329f2210c76994c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4809d30a0cc46e3f91ed3f5a77cdc884f312e8b30b9597cb329f2210c76994c3.exe
Resource
win10v2004-20240226-en
General
-
Target
4809d30a0cc46e3f91ed3f5a77cdc884f312e8b30b9597cb329f2210c76994c3
-
Size
158KB
-
MD5
0c47a56446d12ccfcdbb22c0b96311de
-
SHA1
6cf553d18d62ff687ce86dbc87df95de3842d244
-
SHA256
4809d30a0cc46e3f91ed3f5a77cdc884f312e8b30b9597cb329f2210c76994c3
-
SHA512
37c6ed4531513a0f43c84a957fb4bd415fc2085211347df72e6666f9e8b78c7c7135002a644a1e65343c37fa1dc1e2cad3e86d0327e9e6695d9c4318c745d7d9
-
SSDEEP
3072:kbKWrHsz8oFdPr9xJp4EnZVptgKLLOr4mBXQ:KKWzcTPrnJpVftg4y4yA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4809d30a0cc46e3f91ed3f5a77cdc884f312e8b30b9597cb329f2210c76994c3
Files
-
4809d30a0cc46e3f91ed3f5a77cdc884f312e8b30b9597cb329f2210c76994c3.exe windows:4 windows x86 arch:x86
3ff641a2532b7022e82be1714b58c0d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
VirtualAlloc
VirtualFree
GlobalMemoryStatusEx
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
GetModuleFileNameA
DeleteFileA
CloseHandle
ReadFile
CreateProcessA
CreateFileA
GetTickCount
MoveFileA
WriteFile
GetStartupInfoA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetFileSize
TerminateProcess
user32
WaitForInputIdle
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MessageBoxA
ws2_32
WSAAsyncSelect
recv
select
socket
ntohs
getsockname
WSAStartup
send
htons
inet_addr
connect
WSACleanup
closesocket
gethostbyname
msvcrt
calloc
_stricmp
sprintf
srand
rand
atoi
_ftol
strtod
_CIfmod
floor
_CIpow
free
malloc
strrchr
strchr
modf
realloc
??3@YAXPAX@Z
memmove
strncmp
__CxxFrameHandler
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE