Behavioral task
behavioral1
Sample
8b3f4db4bce746b3e1801a82c8261c5d412ec163dac26ca06191a52a6d726d6b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8b3f4db4bce746b3e1801a82c8261c5d412ec163dac26ca06191a52a6d726d6b.exe
Resource
win10v2004-20240226-en
General
-
Target
8b3f4db4bce746b3e1801a82c8261c5d412ec163dac26ca06191a52a6d726d6b
-
Size
929KB
-
MD5
13bb7569841b9e2e294091d4ac1c0386
-
SHA1
7b762e77384a0857fc7768c0e71a6572eddbdd49
-
SHA256
8b3f4db4bce746b3e1801a82c8261c5d412ec163dac26ca06191a52a6d726d6b
-
SHA512
92512fe234cb19ace19fde0c23593b272e76af3d3798c662c3d7862d97d39642f8f8db2f2dc0c2d5636256a8b23bbcbd41221a8459b5db3a87e28c1f783fc8f0
-
SSDEEP
12288:NU3Keh6eBqBWxb2RFt5KSHS9YLvyenR3vhI46FXyE0lSCnaHUWXy91:NU3Ke4PB4b2RkgdL/ntpI9yE0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b3f4db4bce746b3e1801a82c8261c5d412ec163dac26ca06191a52a6d726d6b
Files
-
8b3f4db4bce746b3e1801a82c8261c5d412ec163dac26ca06191a52a6d726d6b.exe windows:4 windows x86 arch:x86
d8c188e7b864769a90b843babd1fe749
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetProcessHeap
CloseHandle
WriteFile
CreateFileA
GetCommandLineA
LoadLibraryA
FreeLibrary
GetProcAddress
LoadLibraryExA
GetCurrentProcess
CreateMutexA
OpenMutexA
GetModuleFileNameA
GetTickCount
shlwapi
PathFileExistsA
user32
TranslateMessage
wsprintfA
GetMessageA
MessageBoxA
DispatchMessageA
PeekMessageA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
msvcrt
sprintf
strrchr
_ftol
strchr
atoi
oleaut32
VariantTimeToSystemTime
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 917KB - Virtual size: 930KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 834B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE