Behavioral task
behavioral1
Sample
04f07775decbfc43b074d9cdbd2c847d88eb65ce46a6ece016aa978f61b4af2d.exe
Resource
win7-20240221-en
General
-
Target
04f07775decbfc43b074d9cdbd2c847d88eb65ce46a6ece016aa978f61b4af2d
-
Size
616KB
-
MD5
1e4b72ad1458dd1dbf2ed3211d772ff9
-
SHA1
7d32c2d0dc5cc4004d8969bc2eb8688f30da516c
-
SHA256
04f07775decbfc43b074d9cdbd2c847d88eb65ce46a6ece016aa978f61b4af2d
-
SHA512
16ebf4e285bd317f8d7cd81ccd7272fbcb5cff1b1eb8f6da55df17e127294f1a3c53c810b3b59e9de211d0dfee3e51865f5c4654b08e85280d7c59f00247372f
-
SSDEEP
12288:cqlmg4La8Ctv2fk8/0IWlfyY3GFrGW/D3oVZpQ5cGrNptYaQ:cqlmgvTtvA/0blff3GFrGED3oV7Q5cGJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04f07775decbfc43b074d9cdbd2c847d88eb65ce46a6ece016aa978f61b4af2d
Files
-
04f07775decbfc43b074d9cdbd2c847d88eb65ce46a6ece016aa978f61b4af2d.exe windows:4 windows x86 arch:x86
d29f05a56974c8bdb7702244c8fd1eb9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_ftol
strrchr
strncmp
strncpy
_strnicmp
kernel32
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
LocalSize
RtlMoveMemory
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
WaitForSingleObject
CloseHandle
GetEnvironmentVariableA
TerminateProcess
lstrcpyn
Process32First
lstrlenA
Process32Next
OpenProcess
CreateWaitableTimerA
SetWaitableTimer
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
CreateFileA
DeleteFileA
GetCommandLineA
GetModuleFileNameA
CreateToolhelp32Snapshot
user32
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
GetMessageA
PeekMessageA
shell32
SHGetSpecialFolderPathA
StrCmpNIA
ntdll
ZwUnmapViewOfSection
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 580KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE