Behavioral task
behavioral1
Sample
795afbed37646d07b774b7f1a1355e97b07fe7088c85629fc8d0b2bdd4a4c2fd.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
795afbed37646d07b774b7f1a1355e97b07fe7088c85629fc8d0b2bdd4a4c2fd.exe
Resource
win10v2004-20240508-en
General
-
Target
795afbed37646d07b774b7f1a1355e97b07fe7088c85629fc8d0b2bdd4a4c2fd
-
Size
202KB
-
MD5
760f4b6e67c6cffd0aca67b618c13a6c
-
SHA1
b96302a33d66b5535714aa02278c3043b78d78d7
-
SHA256
795afbed37646d07b774b7f1a1355e97b07fe7088c85629fc8d0b2bdd4a4c2fd
-
SHA512
307df5c6d9289328618b0a54007c2458e3b155046a8c2039f6a3e8a958e5f209d8b8aeb49c1511cd2cdae0f64ded6b4e5a3a28f32c8368b62c205796327bd97c
-
SSDEEP
6144:Y9exgHUj3xw23jtMeX4vdBuF0dGCWZVonK:YAxgHUj3xwmjtMeX4VBuF0dG5l
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 795afbed37646d07b774b7f1a1355e97b07fe7088c85629fc8d0b2bdd4a4c2fd
Files
-
795afbed37646d07b774b7f1a1355e97b07fe7088c85629fc8d0b2bdd4a4c2fd.exe windows:4 windows x86 arch:x86
a3765c7103a80e09d71b4e2614a79ed1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalAlloc
LocalFree
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CreateDirectoryA
GetPrivateProfileStringA
GetModuleFileNameA
WriteFile
CreateFileA
GetLocalTime
WritePrivateProfileStringA
ReadFile
GetFileSize
MoveFileA
GetTempPathA
WaitForSingleObject
CreateProcessA
GetProcessTimes
DeleteFileA
FindNextFileA
FindFirstFileA
FindClose
MultiByteToWideChar
GetUserDefaultLCID
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetSystemInfo
TerminateProcess
GetDiskFreeSpaceExA
Sleep
QueryDosDeviceA
GetLogicalDriveStringsA
Module32First
VirtualQueryEx
lstrcpyn
WideCharToMultiByte
OpenProcess
IsWow64Process
GetProcAddress
GetModuleHandleA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateEventA
OpenEventA
CloseHandle
GetStartupInfoA
ws2_32
setsockopt
gethostbyname
htonl
connect
ntohs
getpeername
send
recv
gethostname
sendto
htons
inet_ntoa
recvfrom
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
bind
inet_addr
closesocket
getsockname
WSAEventSelect
WSACloseEvent
socket
WSACleanup
WSACreateEvent
WSAStartup
listen
accept
__WSAFDIsSet
select
psapi
GetProcessImageFileNameA
GetModuleFileNameExA
shell32
SHGetSpecialFolderPathA
ExtractIconA
ShellExecuteA
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA
CryptReleaseContext
wininet
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetOpenA
InternetReadFile
shlwapi
PathIsDirectoryA
PathFileExistsA
user32
ShowWindow
wsprintfA
GetSystemMetrics
DispatchMessageA
TranslateMessage
GetMessageA
GetParent
SetWindowPos
IsWindowVisible
FindWindowExA
DestroyIcon
ReleaseDC
DrawIconEx
GetDC
GetIconInfo
IsWindow
GetWindowThreadProcessId
MessageBoxA
PeekMessageA
GetClassNameA
gdi32
CreateCompatibleDC
SelectObject
CreateDIBSection
BitBlt
DeleteObject
DeleteDC
CreateCompatibleBitmap
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
ole32
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
msvcrt
__CxxFrameHandler
realloc
memmove
strchr
strtod
srand
modf
_onexit
__dllonexit
strncmp
strncpy
floor
sprintf
_CIfmod
rand
??2@YAPAXI@Z
strrchr
??3@YAXPAX@Z
_ftol
atoi
malloc
free
oleaut32
VariantCopy
RegisterTypeLi
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
Sections
.text Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE