Behavioral task
behavioral1
Sample
062cde40a55cfc7842a0ae0a7d0df9bec033ce1b87e21f7899e2cd10b1539340.exe
Resource
win7-20240221-en
General
-
Target
062cde40a55cfc7842a0ae0a7d0df9bec033ce1b87e21f7899e2cd10b1539340
-
Size
437KB
-
MD5
5924ee002db9e82b4c8a27801bcd967f
-
SHA1
40e1029be8ca787b18ecfbc8941ff5752d035389
-
SHA256
062cde40a55cfc7842a0ae0a7d0df9bec033ce1b87e21f7899e2cd10b1539340
-
SHA512
d85d5fad0a556119529ceb0180725bea9e1df9f5bb12887f6614dc13676e0da60fdaf080e355cdb6f5f9fb93e06bf7f47f0172e17c6ebb95f904b166be824be7
-
SSDEEP
6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3ZmZ:J1R7gpAwsuvDNP/xyqk09TyCcZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 062cde40a55cfc7842a0ae0a7d0df9bec033ce1b87e21f7899e2cd10b1539340
Files
-
062cde40a55cfc7842a0ae0a7d0df9bec033ce1b87e21f7899e2cd10b1539340.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 352KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 78KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE