Behavioral task
behavioral1
Sample
e0fa7c96caa8b6f8b485a91a6177fd1ea72b5caf22d68da383649ba6496940a3.exe
Resource
win7-20240221-en
General
-
Target
c3e7b837336b115136a609292d8e1cca.bin
-
Size
124KB
-
MD5
c4f422c0879333ddaa677eef03bcf3af
-
SHA1
ea98b5180fd118ec770477d828707abb2df1e85b
-
SHA256
0c6c069ae8d4e1bc1c45f7ee859bf2175d27037a9485bacf98deecf58268df19
-
SHA512
cb188c46f7ad1fa0d431c6eb68424ee990943baa4094a56684f3cde4c49348f2289e7675f91f7623d779995e21f73ebdd6963f885f65054e2b703ceafe827229
-
SSDEEP
3072:wkkI2zc0pt+8sEeGPopObSnr2vW0C77/kBK/jIjJ/Xq:wkwDtEEeLpO3vWn77MhF/6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/e0fa7c96caa8b6f8b485a91a6177fd1ea72b5caf22d68da383649ba6496940a3.exe family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e0fa7c96caa8b6f8b485a91a6177fd1ea72b5caf22d68da383649ba6496940a3.exe
Files
-
c3e7b837336b115136a609292d8e1cca.bin.zip
Password: infected
-
e0fa7c96caa8b6f8b485a91a6177fd1ea72b5caf22d68da383649ba6496940a3.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 387KB - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE