Behavioral task
behavioral1
Sample
9201a001981d512bc68b9d677942007331c0a2b570f6637cb158de12624a1cd7.exe
Resource
win7-20240221-en
General
-
Target
9201a001981d512bc68b9d677942007331c0a2b570f6637cb158de12624a1cd7.exe
-
Size
447KB
-
MD5
e42a8fab14515c57bfbc85669e206754
-
SHA1
7d7eb4346282b462eb272af0acb1dc188a67a57c
-
SHA256
9201a001981d512bc68b9d677942007331c0a2b570f6637cb158de12624a1cd7
-
SHA512
5ddc0b3a8e4a81d8a3ae7004ad02c04b3c205846b0a757b71eda991dd8cf516d84e8e7a94e416a8f47dd059ee98be8fc7f97d17f19ee09ec4632b1e91adf17ca
-
SSDEEP
6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubZ:sZ++qlRBBOxQDU2XWIg6BiZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9201a001981d512bc68b9d677942007331c0a2b570f6637cb158de12624a1cd7.exe
Files
-
9201a001981d512bc68b9d677942007331c0a2b570f6637cb158de12624a1cd7.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 360KB - Virtual size: 360KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 79KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE