Behavioral task
behavioral1
Sample
56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797.exe
Resource
win10v2004-20240226-en
General
-
Target
56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797.exe
-
Size
504KB
-
MD5
221910e307b7e40e3b017f7d217e9772
-
SHA1
04e9a897039cd0b43bb6ab99a56a6eac947cfbc8
-
SHA256
56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797
-
SHA512
b09441b83e73a1eb95224493035914d73901a07306f5d3b3c19751e3beb2707600d84e5101809f7bc55e644d312ccd1af375cb87473e09dee4c474f49018747c
-
SSDEEP
3072:6VmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPDJKUuTx871KD:6cHpJfHElepVuWwP5YcQfg8J+oj/J+3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797.exe
Files
-
56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 408KB - Virtual size: 408KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE