Behavioral task
behavioral1
Sample
503ff2c4409c25b17213459b1b8a70d3952c9d81603589900a2678f06f9610c1.exe
Resource
win7-20240221-en
General
-
Target
503ff2c4409c25b17213459b1b8a70d3952c9d81603589900a2678f06f9610c1
-
Size
356KB
-
MD5
9a855aa101380ba0d3b3567e2aa47890
-
SHA1
c87ed191645241a688cfb9d6d7d6e46455830711
-
SHA256
503ff2c4409c25b17213459b1b8a70d3952c9d81603589900a2678f06f9610c1
-
SHA512
82c351084c18f8f96782fad1ade224c43f3603a60909feb96e6b700206dd93b3e426b57a9844a59ccefaa56456942e5a3aed2e871ab39e40517bed566182ef9e
-
SSDEEP
6144:/qvk3Q5ibjnNuuXckaL7pbRBkce97aw/N4L7o2:/qvMQ5ibjnwka3pbRC19Gw/Nso2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 503ff2c4409c25b17213459b1b8a70d3952c9d81603589900a2678f06f9610c1
Files
-
503ff2c4409c25b17213459b1b8a70d3952c9d81603589900a2678f06f9610c1.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE