Behavioral task
behavioral1
Sample
994a6c279e2849c4eb2d959776bc2c76f78c5b575558edd71e59ba1bc14f0226.exe
Resource
win7-20231129-en
General
-
Target
4cfa917510615db87a83b936caceec7d.bin
-
Size
107KB
-
MD5
a4fd46c983024cfedee70e723361419a
-
SHA1
8da0271bc81f6309eaceca20cdb1d4c9bc97363d
-
SHA256
56a7bf60f326b11862161d5ea114dcb18e39bd145bd0bd0f73863a3c0c25096d
-
SHA512
7ad29b7155c2e4e09b5f9820e49a5a9b95928d89a08c7b2c47a75aa228a84b9c0a1a72dfead4a91f85ceabaf0ff626d8c22447e458176c7e9bd1d662c5108ca1
-
SSDEEP
3072:M/xRiSL/7P8Q+utg1XXWD23uu1ij0rCKFJc/:qxRBTi1XXW63Z00rLFJc/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/994a6c279e2849c4eb2d959776bc2c76f78c5b575558edd71e59ba1bc14f0226.exe family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/994a6c279e2849c4eb2d959776bc2c76f78c5b575558edd71e59ba1bc14f0226.exe
Files
-
4cfa917510615db87a83b936caceec7d.bin.zip
Password: infected
-
994a6c279e2849c4eb2d959776bc2c76f78c5b575558edd71e59ba1bc14f0226.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 324KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE