Behavioral task
behavioral1
Sample
d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe
Resource
win7-20240319-en
General
-
Target
46fdf094d22f13a258a5a491b62be581d5618bb687172a7dabd16388de994db3
-
Size
109KB
-
MD5
f272d42c72219e6a2552ec971087cd90
-
SHA1
36ed62bb79dcf5baad4e9e087dd34d933c6a5e05
-
SHA256
46fdf094d22f13a258a5a491b62be581d5618bb687172a7dabd16388de994db3
-
SHA512
07e8ce569ef72ae5dd73cb416f5a01d613cc314d6e77a8dbf09a4ca68bea2569ebc39fc803f3c7ea69549ecf79afb4b58653f27b4ff6cbae2c1ad186c3b0d45a
-
SSDEEP
3072:tYo9m0dZCeaRabx8NWNYkzW54XdF/9Anh5tuI3c:mo9hdZXYabx803S5+RGju
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe
Files
-
46fdf094d22f13a258a5a491b62be581d5618bb687172a7dabd16388de994db3.zip
Password: infected
-
d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE