Behavioral task
behavioral1
Sample
8b0e5681a442acc055a192244791e3e551ba433da477211cb7b96d1646facaa0.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8b0e5681a442acc055a192244791e3e551ba433da477211cb7b96d1646facaa0.exe
Resource
win10v2004-20240419-en
General
-
Target
8b0e5681a442acc055a192244791e3e551ba433da477211cb7b96d1646facaa0
-
Size
161KB
-
MD5
25faa60d52687d4c90acbdb9b6de5a78
-
SHA1
b30f0d8522f173ad212c475498b06b04db37395f
-
SHA256
8b0e5681a442acc055a192244791e3e551ba433da477211cb7b96d1646facaa0
-
SHA512
8ae323d829b5292bb65be48b5e14e97d762ee4e78dcea5534019039e00e7f2a4d1e6536e0117ad526afcbeaed42991dcb6a401ca84eb94b18b0aa150131e7a6a
-
SSDEEP
1536:1mV4WaWNVPUTW6FViP6+1QrE2WrG/t3v24R+t6gz:1C4rWNVB4/Z/3v24R+t6gz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b0e5681a442acc055a192244791e3e551ba433da477211cb7b96d1646facaa0
Files
-
8b0e5681a442acc055a192244791e3e551ba433da477211cb7b96d1646facaa0.exe windows:4 windows x86 arch:x86
5fdb18d3bea12632a408ea4c5005ef00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
RtlMoveMemory
lstrcpyn
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersion
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
GetMessageA
PeekMessageA
advapi32
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ