Behavioral task
behavioral1
Sample
20b512c963a13d2bd46a06e8e6302dab9b85f4164ae90145a7bacf830bec01a7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20b512c963a13d2bd46a06e8e6302dab9b85f4164ae90145a7bacf830bec01a7.exe
Resource
win10v2004-20240226-en
General
-
Target
20b512c963a13d2bd46a06e8e6302dab9b85f4164ae90145a7bacf830bec01a7
-
Size
2.9MB
-
MD5
9ab0a0672d26c948a3ecaa3c9e1049c3
-
SHA1
1c25fa915dcaa24334a59262c664820b3674830b
-
SHA256
20b512c963a13d2bd46a06e8e6302dab9b85f4164ae90145a7bacf830bec01a7
-
SHA512
f99a854ce3091f9522b98be0865a051799795fbb43427cd3868cc55ea7146ced9b82141e2d1bf4db81c446fa37deba12fd3530cdda9cb59a038a0249ee7cdeaa
-
SSDEEP
49152:uBFjbl6f4ysXOtaSgT900Dsc0J8Er/NsaMCUpoqQcj2yKl3RUh5y:03sMOtaSgq0Dsc2NsaM0cxwBuy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20b512c963a13d2bd46a06e8e6302dab9b85f4164ae90145a7bacf830bec01a7
Files
-
20b512c963a13d2bd46a06e8e6302dab9b85f4164ae90145a7bacf830bec01a7.exe windows:4 windows x86 arch:x86
fe361d01e72aff95af8e5346400888c6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
LoadResource
LockResource
CreateProcessA
lstrcpyn
RtlMoveMemory
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
OpenProcess
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
lstrcatA
GetCurrentThreadId
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
FindResourceA
GetModuleFileNameA
CreateDirectoryA
WriteFile
CreateFileA
GetFileSize
DeleteFileA
SetFileAttributesA
Sleep
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetModuleHandleA
TerminateThread
DeleteCriticalSection
CreateThread
CreateEventA
IsBadReadPtr
OpenEventA
user32
GetSystemMetrics
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
GetFocus
SetFocus
AttachThreadInput
MoveWindow
EnableWindow
IsWindowEnabled
CallWindowProcA
CopyImage
ShowWindow
EnumChildWindows
IsWindowVisible
GetWindowThreadProcessId
MessageBoxTimeoutA
PeekMessageA
shlwapi
PathFileExistsA
PathIsDirectoryA
PathRemoveExtensionA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
gdi32
DeleteObject
msvcrt
calloc
__CxxFrameHandler
malloc
free
_strnicmp
sprintf
??3@YAXPAX@Z
atoi
_ftol
strncpy
strncmp
floor
_CIfmod
tolower
_CIpow
strrchr
strchr
modf
memmove
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE