Behavioral task
behavioral1
Sample
1bb253e19b29ffe73642aba3d3b59269f3949a68fec9cfe89183584acf57c3d0.exe
Resource
win7-20240221-en
General
-
Target
1bb253e19b29ffe73642aba3d3b59269f3949a68fec9cfe89183584acf57c3d0.exe
-
Size
113KB
-
MD5
a4d78e958ef9926ed4033b4337287dc2
-
SHA1
7b9b116f4dd08f4a799cb8af2808b53e012aeccc
-
SHA256
1bb253e19b29ffe73642aba3d3b59269f3949a68fec9cfe89183584acf57c3d0
-
SHA512
cd2b2386fa5b40f991ae957d1026c2f69380424cb476d57af7c133cb58625a5bc64d5801e4f01f191890efa1c04bf1812e509ebc4ec041d5d762b3349deb6a52
-
SSDEEP
1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27q4rf:bav9OdPx8wJ4rm7q6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bb253e19b29ffe73642aba3d3b59269f3949a68fec9cfe89183584acf57c3d0.exe
Files
-
1bb253e19b29ffe73642aba3d3b59269f3949a68fec9cfe89183584acf57c3d0.exe.exe windows:4 windows x86 arch:x86
e5ac0f9205c73a7dd3d8c67873453d3c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlMoveMemory
GetComputerNameA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
CreateThread
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
IsBadReadPtr
CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
lstrcpynA
CreateProcessA
GetStartupInfoA
DeleteFileA
GetTickCount
Sleep
FindClose
FindNextFileA
RemoveDirectoryA
FindFirstFileA
SetFileAttributesA
GetUserDefaultLCID
FreeLibrary
LoadLibraryA
LCMapStringA
CreateEventA
OpenEventA
MoveFileA
CreateDirectoryA
GetTempPathA
GetCommandLineA
GetModuleFileNameA
WaitForSingleObject
ExitProcess
user32
wsprintfA
TranslateMessage
GetMessageA
PeekMessageA
GetDC
DispatchMessageA
MessageBoxA
GetDesktopWindow
ReleaseDC
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CreateProcessAsUserA
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
ws2_32
ntohs
inet_addr
bind
listen
WSACleanup
socket
htons
accept
recv
send
WSASocketA
WSAStartup
closesocket
gdi32
GetDeviceCaps
ole32
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
msvcrt
malloc
free
modf
memmove
_ftol
atoi
strchr
strncpy
_CIfmod
floor
strrchr
__CxxFrameHandler
_strnicmp
rand
srand
tolower
??2@YAPAXI@Z
sprintf
??3@YAXPAX@Z
strncmp
shlwapi
PathFileExistsA
oleaut32
VariantClear
SysAllocString
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetLBound
VariantChangeType
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantInit
SafeArrayDestroy
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE