Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240226-en
General
-
Target
tmp
-
Size
584KB
-
MD5
cdda0e31a20048920abfc1f4d75bd2c4
-
SHA1
2578e401ff22633ee641da52cc4f3ba6cc666b7a
-
SHA256
a9bfd00cfc27c06d2d2dbe963300e534980382a3728ee1637e46eef07a9beee9
-
SHA512
e91333bfaf997a6162e7231b46207eb9d0ab412c7abcdf40f4de8e0646dee16db64c77601ae0372f253d6c6b24fea13cc8938294477b2ac1cef0c1ce4ec4fcb9
-
SSDEEP
12288:yD4fhMbQQKkggmVaKv36LF0YPf1L6VYe+PjaGSO:yD4fhtQKkggmVaCkWYPf1L6VYFavO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 464KB - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE