Behavioral task
behavioral1
Sample
39192724a632a2227962a06591ebb245793cbb69ed522930361ce9f1fe69d01d.exe
Resource
win7-20240221-en
General
-
Target
39192724a632a2227962a06591ebb245793cbb69ed522930361ce9f1fe69d01d
-
Size
1.6MB
-
MD5
54764c1261f18516428334501c791ae8
-
SHA1
205e9e041daa508bcef2e6f58c50e16a6bd0082d
-
SHA256
39192724a632a2227962a06591ebb245793cbb69ed522930361ce9f1fe69d01d
-
SHA512
a18b1c3771666e8db421cae69e0d27f0b5a4ee9ce490df27fce3788b28c54149862cde5dbb54aa41867f6cf14d05a012bb1e0746cc4aa3bd0d29b8a55461299e
-
SSDEEP
49152:/sfdo4OiZrq1DfP+rsNADtV6v+L0uSwiPSCmDS+5uSlOQ:kFo4OiZrq1DfPHNADtV6v+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39192724a632a2227962a06591ebb245793cbb69ed522930361ce9f1fe69d01d
Files
-
39192724a632a2227962a06591ebb245793cbb69ed522930361ce9f1fe69d01d.exe windows:4 windows x86 arch:x86
b2bfcf70e2adad712eddfa005a46abee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableW
RtlZeroMemory
CloseHandle
VirtualQueryEx
LoadLibraryA
VirtualQuery
CreateToolhelp32Snapshot
Module32First
Module32Next
ExitProcess
lstrcmpiA
GlobalAlloc
GetCurrentThreadId
GlobalFree
GetModuleHandleA
GetProcAddress
GetCurrentThread
ExitThread
OpenThread
GetThreadTimes
VirtualFree
GetCurrentProcess
FlushInstructionCache
VirtualProtect
LocalSize
SetEnvironmentVariableA
HeapReAlloc
HeapFree
Sleep
GetTickCount
GetCommandLineA
GetModuleFileNameA
FreeLibrary
LCMapStringA
SetUnhandledExceptionFilter
FlushFileBuffers
SetStdHandle
VirtualAlloc
GetProcessHeap
RtlMoveMemory
GetStringTypeW
GetStringTypeA
GetEnvironmentVariableA
GetCurrentProcessId
TlsSetValue
IsBadCodePtr
TlsGetValue
TlsAlloc
IsBadReadPtr
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
MultiByteToWideChar
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetStartupInfoA
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
SetLastError
GetLastError
GetVersionExA
HeapDestroy
HeapCreate
WriteFile
RaiseException
user32
PeekMessageA
wvsprintfA
wsprintfA
DispatchMessageA
MessageBoxA
GetDesktopWindow
GetWindow
GetWindowThreadProcessId
GetClassNameA
TranslateMessage
GetMessageA
shell32
CommandLineToArgvW
iphlpapi
GetIpForwardTable
advapi32
DuplicateTokenEx
CreateProcessAsUserA
AdjustTokenPrivileges
SetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
ChangeServiceConfig2A
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
ws2_32
WSAStartup
oleaut32
VariantTimeToSystemTime
Sections
.text Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE