Behavioral task
behavioral1
Sample
930bb917a04f60ac37facb633aa7fba7f35c66cd766ae357ed1dcbeb52d28dd3.exe
Resource
win7-20240215-en
General
-
Target
41555cb5cb1f21547d1f8445cacaea0742d378b79736daf8dabee63b6ecfae3d
-
Size
125KB
-
MD5
4b50a5ad3e9f851f589e8267769d53bb
-
SHA1
db1ac8dd3d6ae220466e5a0b483a643b5bd7e84f
-
SHA256
41555cb5cb1f21547d1f8445cacaea0742d378b79736daf8dabee63b6ecfae3d
-
SHA512
14fd68f1d697373bb5478305b449221cfa90d711d111ebdb38e8d7674189fa28ad596584b32071d92aebeda3c5696d1fc48ffd59fe79c958c4ff5bfbcf76966a
-
SSDEEP
3072:Dj3xBAYO3VjeQwLy3jYiueXbRIAQmJN1uavic+tyms3r84z:Dj3nOVjeIX5XtCnyms7rz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/930bb917a04f60ac37facb633aa7fba7f35c66cd766ae357ed1dcbeb52d28dd3.exe family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/930bb917a04f60ac37facb633aa7fba7f35c66cd766ae357ed1dcbeb52d28dd3.exe
Files
-
41555cb5cb1f21547d1f8445cacaea0742d378b79736daf8dabee63b6ecfae3d.zip
Password: infected
-
930bb917a04f60ac37facb633aa7fba7f35c66cd766ae357ed1dcbeb52d28dd3.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 391KB - Virtual size: 390KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE