Behavioral task
behavioral1
Sample
7553dcd680c717fb63a68fcf0e1bc1d38f1a7daddd3fd813bddfd59925142c17.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7553dcd680c717fb63a68fcf0e1bc1d38f1a7daddd3fd813bddfd59925142c17.exe
Resource
win10v2004-20240412-en
General
-
Target
7553dcd680c717fb63a68fcf0e1bc1d38f1a7daddd3fd813bddfd59925142c17
-
Size
166KB
-
MD5
4781e45e197ea3735661ed8efecfe3a3
-
SHA1
044c17b7f90cbe0f195633d690fb6da815cb0007
-
SHA256
7553dcd680c717fb63a68fcf0e1bc1d38f1a7daddd3fd813bddfd59925142c17
-
SHA512
25e03609a7e0403f0679468297f10e623e38b7b56f88de2863aed44ef873954189c7a142cc73e553457890a414f2f64d8b3c5be3288056b42fc9bd6b73f4b19c
-
SSDEEP
1536:1mV4WaWNVPUTW6FViP6+1QrE2WrG/t3v24R+t6gz:1C4rWNVB4/Z/3v24R+t6gz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7553dcd680c717fb63a68fcf0e1bc1d38f1a7daddd3fd813bddfd59925142c17
Files
-
7553dcd680c717fb63a68fcf0e1bc1d38f1a7daddd3fd813bddfd59925142c17.exe windows:4 windows x86 arch:x86
5fdb18d3bea12632a408ea4c5005ef00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
RtlMoveMemory
lstrcpyn
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersion
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
GetMessageA
PeekMessageA
advapi32
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ