Behavioral task
behavioral1
Sample
d1600eaff3288d71dd02b2c7bd2b827eb29087eec59f537a6d3084fda79e1d0d.exe
Resource
win7-20240221-en
General
-
Target
67fe18213d79fd77698b300eb47ca826.bin
-
Size
100KB
-
MD5
c409a03350869d69c29273cba80393d0
-
SHA1
b3c5400d30900625dd50b26cfdea94176965bd3e
-
SHA256
372e635bb96e4fd307ec6b8b65b5f64d71b96386937a281843841b32a743f9c6
-
SHA512
ee9715f46ffccf02a0e22faf7e7b44b9fa0f7e37d0f037d7d1dc1505ba400b4d2c3175d15dc42969127dd54b0242ec2f11005a297dcebe0614635ea441fea497
-
SSDEEP
1536:bkw3dOz/tNPR3rj2EzPA+jTdsgT9NnczvlfB6ks4buxSJ9L+X0Pz7n62Bai4eymQ:w9NPdc+jTp0zvlfG4buoSkPN8iZKiK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/d1600eaff3288d71dd02b2c7bd2b827eb29087eec59f537a6d3084fda79e1d0d.exe family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d1600eaff3288d71dd02b2c7bd2b827eb29087eec59f537a6d3084fda79e1d0d.exe
Files
-
67fe18213d79fd77698b300eb47ca826.bin.zip
Password: infected
-
d1600eaff3288d71dd02b2c7bd2b827eb29087eec59f537a6d3084fda79e1d0d.exe.exe windows:4 windows x86 arch:x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 300KB - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE