Behavioral task
behavioral1
Sample
6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815.exe
Resource
win10v2004-20240412-en
General
-
Target
703c467db659a594aacf4a16f8cf5ddf78825c9de22d64cb99521dbdc719b2e9
-
Size
137KB
-
MD5
8debcc2f580e76ac6231230f9a41ab95
-
SHA1
73ea356e49f5a5e74d97d0507365ea10dc43bad7
-
SHA256
703c467db659a594aacf4a16f8cf5ddf78825c9de22d64cb99521dbdc719b2e9
-
SHA512
9e369ff2e90c291961ea66fb805e23209df23f6640f107f403ccdc96d16500293608200a5e673c5db6bdf115ef5592aeee4b3e734b55e7ec46bd97d4c90b1edc
-
SSDEEP
3072:iFbAr2upzueLgi6VUWhqKGS1WWCI6l0qXj6FITafVm4LFdik8yJ:+bq8eEi6VUWhqKGWCL58LLFg3yJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule static1/unpack001/6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815.exe family_blackmoon -
resource yara_rule static1/unpack001/6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815.exe
Files
-
703c467db659a594aacf4a16f8cf5ddf78825c9de22d64cb99521dbdc719b2e9.zip
Password: infected
-
6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815.exe.exe windows:4 windows x86 arch:x86
3bb3093a5eeb1047bbdd41c02a894dbe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegOpenKeyA
atl
AtlAxWinInit
AtlAxGetControl
AtlAdvise
AtlUnadvise
AtlUnadvise
gdi32
SelectObject
CreateSolidBrush
DeleteObject
DeleteDC
SetTextColor
SetBkMode
GetStockObject
Rectangle
StretchBlt
SetBkColor
FrameRgn
FillRgn
CreatePatternBrush
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
GetObjectA
GetPixel
kernel32
MulDiv
GlobalUnlock
RtlMoveMemory
GlobalFree
GlobalLock
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
Module32First
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
CancelWaitableTimer
GetTempPathA
TerminateProcess
GetCurrentProcessId
lstrcpyn
GlobalSize
lstrcpyn
SetHandleCount
GetWindowsDirectoryA
LocalSize
SetWaitableTimer
TerminateThread
GetModuleHandleA
GetModuleFileNameA
CreateWaitableTimerA
OpenProcess
lstrlenW
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
GetTickCount
WritePrivateProfileStringA
WriteFile
GetPrivateProfileStringA
GetUserDefaultLCID
DeleteFileA
CreateFileA
GetFileSize
ReadFile
IsBadReadPtr
HeapReAlloc
ExitProcess
HeapAlloc
HeapFree
GetModuleHandleA
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
msimg32
AlphaBlend
TransparentBlt
AlphaBlend
msvcrt
__CxxFrameHandler
malloc
free
modf
memmove
rand
srand
toupper
_CIfmod
floor
_ftol
atoi
strncpy
strrchr
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
tolower
sprintf
strncmp
strtod
_strnicmp
free
oleaut32
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
RegisterTypeLib
VariantChangeType
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromI2
LHashValOfNameSys
LoadTypeLib
OleLoadPicture
OleLoadPicture
shell32
DragAcceptFiles
Shell_NotifyIcon
DragFinish
DragQueryFile
ShellExecuteA
DragFinish
shlwapi
PathFileExistsA
PathFileExistsA
user32
RegisterClassExA
SetActiveWindow
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
DrawTextA
IsIconic
GetSysColor
SetClassLongA
MsgWaitForMultipleObjects
GetClassLongA
SetRect
SetWindowRgn
RemovePropA
GetPropA
IsZoomed
UpdateLayeredWindow
SetPropA
MessageBoxA
SetWindowTextA
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
SetParent
PostMessageA
SetWindowPos
DrawIcon
DrawIconEx
GetIconInfo
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuA
DestroyMenu
AppendMenuA
GetMenuItemCount
InsertMenuA
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringA
GetMenuItemInfoA
GetMenuItemRect
GetMenuState
GetMenuInfo
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
MoveWindow
UpdateWindow
ValidateRect
ScreenToClient
GetWindowRect
GetFocus
SetFocus
GetDlgItem
CreateWindowExA
DestroyIcon
PostQuitMessage
DestroyIcon
TrackMouseEvent
SetCursor
LoadCursorA
DefMDIChildProcA
SendMessageA
GetAsyncKeyState
EndPaint
BeginPaint
GetClassNameA
IsWindow
DispatchMessageA
TranslateMessage
IsDialogMessage
TranslateAccelerator
GetMessageA
KillTimer
SetTimer
CallWindowProcA
FillRect
GetClientRect
InvalidateRect
GetAncestor
GetParent
CopyIcon
CopyImage
SetLayeredWindowAttributes
SetWindowLongA
GetWindowLongA
GetWindowTextA
IsWindowVisible
GetWindowThreadProcessId
GetWindow
GetDesktopWindow
SetMenuItemInfoA
SetMenuItemBitmaps
SetMenuDefaultItem
wsprintfA
PeekMessageA
LoadCursorA
RegisterClassExA
wininet
InternetOpenA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
gdiplus
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipCreateStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipGetImageDimension
GdipCreateBitmapFromScan0
GdipDeletePen
GdipDrawLine
GdipCreatePen1
GdipDeleteGraphics
GdipDrawImageRect
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFontFromDC
GdipDrawRectangleI
GdipDrawRectangle
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipSetWorldTransform
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageRawFormat
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromStreamICM
GdiplusShutdown
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromStream
GdiplusStartup
GdipCreateFont
GdipDeleteFont
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipDrawString
GdipDrawImagePointRect
GdipCreateFromHDC
GdipFillRectangle
GdipDrawLine
combase
CoUninitialize
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CoCreateInstance
CLSIDFromProgID
CreateStreamOnHGlobal
ole32
CoInitialize
OleRun
OleRun
Sections
UPX0 Size: 412KB - Virtual size: 412KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE