Behavioral task
behavioral1
Sample
9698b92534f99e0f5b884fb7985c5a53a365ac21b23e12cab162a539ccf7fe66.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9698b92534f99e0f5b884fb7985c5a53a365ac21b23e12cab162a539ccf7fe66.exe
Resource
win10v2004-20240412-en
General
-
Target
4603c5d51f014ff519f325f13ed10fb2924f66248f8a3fbe380d0fe02a995b33
-
Size
130KB
-
MD5
e1d9d9a3f8c4669fbba33dbdb3afba58
-
SHA1
9dfc3130ce60be44ed244c6859b432f940f032f9
-
SHA256
4603c5d51f014ff519f325f13ed10fb2924f66248f8a3fbe380d0fe02a995b33
-
SHA512
12873d808f53e475f31f3375a973b54348f929ccc6a9d4eef455a0fe2f890c22a4a35a34f99ea82a1b38ea99219c4a40343f2c3050143c38730c30b2003e5526
-
SSDEEP
3072:pYtbWac80hrlHGh90J+ce3e9EbGoWMXyhqAwT5Lv:e7cXh8h90jeKEbGqyhqAQj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/9698b92534f99e0f5b884fb7985c5a53a365ac21b23e12cab162a539ccf7fe66.exe family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9698b92534f99e0f5b884fb7985c5a53a365ac21b23e12cab162a539ccf7fe66.exe
Files
-
4603c5d51f014ff519f325f13ed10fb2924f66248f8a3fbe380d0fe02a995b33.zip
Password: infected
-
9698b92534f99e0f5b884fb7985c5a53a365ac21b23e12cab162a539ccf7fe66.exe.exe windows:4 windows x86 arch:x86
c4cc56b23288e6ddcbc65e41dd25b3e5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadProcessMemory
CreateRemoteThread
GetCurrentProcessId
GetVersionExA
GetTempPathA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetCommandLineA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetCurrentThreadId
CopyFileA
GetTickCount
GetDiskFreeSpaceExA
GetCurrentDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CreateProcessA
GetStartupInfoA
EndUpdateResourceA
InterlockedExchange
InterlockedCompareExchange
GetStringTypeExA
GetSystemInfo
VirtualQuery
UpdateResourceA
RtlMoveMemory
lstrcpynW
BeginUpdateResourceA
GetComputerNameA
WideCharToMultiByte
MultiByteToWideChar
VirtualProtect
QueryDosDeviceA
WriteFile
GetLogicalDriveStringsA
GetSystemDirectoryA
GetWindowsDirectoryA
GetLastError
GetCurrentProcess
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
HeapSize
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
IsBadCodePtr
SetStdHandle
FlushFileBuffers
user32
LoadStringA
wsprintfA
DispatchMessageA
MessageBoxA
RegisterWindowMessageA
MsgWaitForMultipleObjects
TranslateMessage
GetMessageA
PeekMessageA
advapi32
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
shlwapi
PathFindFileNameA
PathFileExistsA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 237KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 176KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE