Behavioral task
behavioral1
Sample
759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c.exe
Resource
win10v2004-20240226-en
General
-
Target
759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c.exe
-
Size
458KB
-
MD5
5ebf47a6de326bf83e254895e416af4d
-
SHA1
02559db1fc9cae58c0a7e47898a9bc855c92e4da
-
SHA256
759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c
-
SHA512
b1089e3c945695d93313b6964fad4e0e50b49e5036292dcd5e9a276e1c99253617b78e17f125caab6b779a3b9675c3a9ad8f2636f78a3dc3de912015c83faf33
-
SSDEEP
6144:uvbuWQu/cuaS2l8iE0B55FrJJJekPdi/2gAge+HO:uvqWQub2lrE0B55FpekPdi/2RCO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c.exe
Files
-
759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c.exe.exe windows:4 windows x86 arch:x86
391b34fdb03bbbe961a380d74dcff2da
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyA
RegCloseKey
atl
AtlAxGetControl
AtlAdvise
AtlUnadvise
AtlAxWinInit
AtlAxWinInit
gdi32
CreateSolidBrush
SelectObject
DeleteObject
DeleteDC
SetTextColor
SetBkMode
GetStockObject
Rectangle
StretchBlt
GetPixel
GetObjectA
ExtCreateRegion
CombineRgn
CreateRoundRectRgn
CreatePatternBrush
FillRgn
FrameRgn
SetBkColor
kernel32
LocalSize
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
GetCurrentProcessId
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
Module32First
GlobalAlloc
GlobalLock
RtlMoveMemory
MulDiv
lstrcpyn
GlobalSize
lstrcpyn
WideCharToMultiByte
GetTempPathA
GetWindowsDirectoryA
GetModuleFileNameA
lstrlenW
MultiByteToWideChar
CloseHandle
GlobalFree
TerminateThread
GetModuleHandleA
GlobalUnlock
GetProcessHeap
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
GetTickCount
WritePrivateProfileStringA
GetUserDefaultLCID
WriteFile
GetPrivateProfileStringA
CreateFileA
GetFileSize
ReadFile
IsBadReadPtr
HeapReAlloc
ExitProcess
HeapAlloc
GetModuleHandleA
GetFileAttributesA
SetFileAttributesA
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
msimg32
AlphaBlend
TransparentBlt
AlphaBlend
msvcrt
__CxxFrameHandler
malloc
free
memmove
modf
rand
srand
toupper
_CIfmod
strchr
floor
??2@YAPAXI@Z
strrchr
_ftol
atoi
??3@YAXPAX@Z
strncpy
tolower
sprintf
strncmp
strtod
_strnicmp
free
oleaut32
VarR8FromI2
LoadTypeLib
LHashValOfNameSys
RegisterTypeLib
SafeArrayCreate
VariantChangeType
VariantInit
SafeArrayDestroy
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
OleLoadPicture
VarR8FromCy
VarR8FromCy
shell32
Shell_NotifyIcon
DragFinish
DragQueryFile
ShellExecuteA
DragAcceptFiles
DragFinish
shlwapi
PathFileExistsA
PathFileExistsA
user32
RegisterClassExA
SetActiveWindow
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
DrawTextA
IsZoomed
IsIconic
GetSysColor
MsgWaitForMultipleObjects
SetClassLongA
GetClassLongA
SetRect
SetWindowRgn
GetSystemMetrics
UpdateLayeredWindow
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
SetParent
PostMessageA
SetWindowPos
MoveWindow
UpdateWindow
ValidateRect
ScreenToClient
GetWindowRect
GetFocus
LoadMenuA
DrawIcon
CreateWindowExA
DestroyIcon
PostQuitMessage
DestroyIcon
TrackMouseEvent
SetCursor
LoadCursorA
DefMDIChildProcA
SendMessageA
GetAsyncKeyState
EndPaint
BeginPaint
GetClassNameA
IsWindow
DispatchMessageA
TranslateMessage
IsDialogMessage
TranslateAccelerator
GetMessageA
CallWindowProcA
FillRect
GetClientRect
InvalidateRect
GetAncestor
GetParent
CopyIcon
CopyImage
SetLayeredWindowAttributes
SetWindowLongA
GetWindowLongA
GetWindowTextA
IsWindowVisible
GetWindowThreadProcessId
GetWindow
GetDesktopWindow
DestroyMenu
DrawIconEx
GetIconInfo
CreateMenu
CreatePopupMenu
GetDlgItem
GetSystemMenu
AppendMenuA
GetMenuItemCount
InsertMenuA
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringA
GetMenuItemInfoA
GetMenuItemRect
GetMenuState
GetMenuInfo
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoA
SetMenuItemBitmaps
SetMenuDefaultItem
wsprintfA
PeekMessageA
SetFocus
LoadCursorA
RegisterClassExA
wininet
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetOpenA
gdiplus
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipCreateFontFromDC
GdipCreateFont
GdipDeleteFont
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipDrawString
GdipDrawImagePointRect
GdipFillRectangle
GdipGetImageDimension
GdipCreateBitmapFromScan0
GdipDeletePen
GdipDrawLine
GdipCreatePen1
GdipDeleteGraphics
GdipDrawImageRect
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDrawRectangleI
GdipDrawRectangle
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipSetWorldTransform
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageRawFormat
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromStreamICM
GdiplusShutdown
GdipSaveImageToStream
GdipCreateBitmapFromStream
GdipDisposeImage
GdiplusStartup
GdipDrawLine
combase
CLSIDFromProgID
CoCreateInstance
StringFromGUID2
CoUninitialize
GetHGlobalFromStream
CreateStreamOnHGlobal
CLSIDFromString
ole32
OleRun
CoInitialize
OleRun
Sections
UPX0 Size: 360KB - Virtual size: 360KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE