Behavioral task
behavioral1
Sample
ls.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ls.exe
Resource
win10v2004-20240508-en
General
-
Target
ls.exe
-
Size
4.2MB
-
MD5
92d458fac734487aaf5faf1c40ffb2a3
-
SHA1
6521cd81e70c3d6404555c5b4f1635826b47c8cd
-
SHA256
b94b976d2ddc188aa0b6b5eeed301efb4733bd0c9d4696db21116e78fc27d575
-
SHA512
103f217fbf290b220410b697121d5d3307ffd71334174754b53dd369ce7ed9d6e74ec35a70dce294b6c2eabccb87ce4ba65206f90f9211fd4a64a408befc9ea8
-
SSDEEP
98304:NlhX3SpsRhVPDcurz0U8lF8aWHTdPNt5LRh:NlhrhVIkb878a0TlRb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ls.exe
Files
-
ls.exe.exe windows:4 windows x86 arch:x86
447c89e0be6ba8b2aa5fcb7856fdaf58
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
kernel32
DeviceIoControl
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
GetTickCount
DeleteFileA
CopyFileA
MoveFileA
FindClose
FindNextFileA
RemoveDirectoryA
FindFirstFileA
LCMapStringA
LoadLibraryA
GetProcAddress
GetCommandLineA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
MultiByteToWideChar
GetLocalTime
InterlockedExchange
CreateFileA
FreeLibrary
ResumeThread
RtlMoveMemory
GetModuleHandleA
SetProcessWorkingSetSize
WaitForSingleObject
GetCurrentThread
SuspendThread
Sleep
WideCharToMultiByte
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
OpenProcess
CreateDirectoryA
GetCurrentProcess
GetEnvironmentVariableA
GetModuleFileNameA
SetFilePointer
GetLastError
GetVersionExA
TerminateProcess
GetTempPathA
GetWindowsDirectoryA
lstrcpyA
GetSystemDirectoryA
lstrlenA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
GetVersion
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
MulDiv
LocalFree
FlushFileBuffers
lstrcpynA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
user32
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClipboardFormatA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
PostMessageA
PostQuitMessage
SetForegroundWindow
SetActiveWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
EnableWindow
GetParent
GetWindow
PtInRect
IsWindowVisible
GetWindowTextA
SetWindowLongA
GetDlgItem
ShowWindow
UpdateWindow
SystemParametersInfoA
GetDC
ReleaseDC
GetWindowThreadProcessId
GetClassNameA
IsWindow
GetWindowRect
GetSystemMetrics
GetCursorPos
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadCursorA
SetCursor
wsprintfA
MessageBoxA
CallWindowProcA
SendMessageA
GetWindowLongA
SetLayeredWindowAttributes
MoveWindow
ClientToScreen
GetClientRect
GetInputState
GetAsyncKeyState
SetWindowPos
FindWindowA
RegisterClassA
gdi32
DeleteObject
DeleteDC
SelectObject
GetDeviceCaps
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
GetStockObject
CreateBitmap
SaveDC
RestoreDC
SetBkColor
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
advapi32
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CreateServiceA
ControlService
CloseServiceHandle
OpenServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ole32
CoInitialize
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
OleRun
CLSIDFromProgID
CoCreateInstance
CLSIDFromString
oledlg
ord8
oleaut32
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VarR8FromBool
VarR8FromCy
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
shell32
SHGetSpecialFolderPathA
comctl32
ord17
Sections
.text Size: 332KB - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.9MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 632B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ