Behavioral task
behavioral1
Sample
d3427bde1810a86a905aa5014a47fed5f90558be19fd899f3862837b2284e5ef.exe
Resource
win7-20240220-en
General
-
Target
d3427bde1810a86a905aa5014a47fed5f90558be19fd899f3862837b2284e5ef
-
Size
357KB
-
MD5
cf7ea18e08db58a21d81ac9da3a4726c
-
SHA1
eac5cc1eb176ea30765359732fa8fa608fcf5e98
-
SHA256
d3427bde1810a86a905aa5014a47fed5f90558be19fd899f3862837b2284e5ef
-
SHA512
4eb804d3a00faeea4e15ab63ffdd70e97ffaa3dfbbb854997f07753d4394bb2ebcc38cb89f7453ec3499e479ebcc8f2ca599a969e71413a0bdb370ff4e6e24aa
-
SSDEEP
6144:mvk3Q5ibjnNuuXckaL7pbRBkce97aw/N4L7oq:mvMQ5ibjnwka3pbRC19Gw/Nsoq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d3427bde1810a86a905aa5014a47fed5f90558be19fd899f3862837b2284e5ef
Files
-
d3427bde1810a86a905aa5014a47fed5f90558be19fd899f3862837b2284e5ef.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE