Behavioral task
behavioral1
Sample
c15a64f121648f71079c895049864950d9531df0073613c6bec81d45a5e2f349.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c15a64f121648f71079c895049864950d9531df0073613c6bec81d45a5e2f349.exe
Resource
win10v2004-20240730-en
General
-
Target
c15a64f121648f71079c895049864950d9531df0073613c6bec81d45a5e2f349
-
Size
924KB
-
MD5
258bb467c8bb32eecb0ad2793e2c2d49
-
SHA1
0a30090709a9e010c5a54f825b4b392ed5e7634a
-
SHA256
c15a64f121648f71079c895049864950d9531df0073613c6bec81d45a5e2f349
-
SHA512
10f36ab2ec4c2ef54b718187e7cc4e5b49032bd77035946cf5cd6c7e335374fdbdbbafc47f2b2e136702fffc4e9914d778bd7fa5149457f6018a76978a02ee41
-
SSDEEP
12288:C29tt2bDaG8Y3W3XsXHIzZXgkL+xVWwnASkbOcFxvHnsOq:CcfuaG8KWsXHIzJKEwnASmOcFx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c15a64f121648f71079c895049864950d9531df0073613c6bec81d45a5e2f349
Files
-
c15a64f121648f71079c895049864950d9531df0073613c6bec81d45a5e2f349.exe windows:4 windows x86 arch:x86
eace5e4ff65da23dc95ac66bb442b9ac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
GlobalAlloc
SetLastError
lstrcatA
GetVersion
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
LocalFree
FlushFileBuffers
lstrcpynA
lstrlenA
LocalAlloc
TlsAlloc
DeleteCriticalSection
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
InterlockedExchange
lstrcpyA
Sleep
WriteFile
CloseHandle
GetTickCount
GetLocalTime
DeleteFileA
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
RtlMoveMemory
VirtualUnlock
RtlZeroMemory
VirtualLock
GetProcAddress
TerminateProcess
OpenEventA
GetVersionExA
GetCurrentProcess
GetLastError
GlobalLock
GlobalUnlock
GlobalFree
CreateFileA
VirtualFree
VirtualAlloc
LoadLibraryA
GetLongPathNameA
GetModuleHandleA
SetCurrentDirectoryA
CreateMutexA
CreateEventA
OpenMutexA
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
FreeLibrary
GetCommandLineA
GetPrivateProfileSectionNamesA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFilePointer
GetPrivateProfileStringA
GetFileSize
ReadFile
CreateDirectoryA
shlwapi
PathIsDirectoryA
PathFileExistsA
user32
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
GetSysColorBrush
LoadStringA
DestroyMenu
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
IsWindowEnabled
EnableWindow
PostMessageA
PostQuitMessage
GetParent
GetWindow
PtInRect
IsWindowVisible
GetWindowLongA
GetWindowTextA
SetWindowLongA
GetDlgItem
SystemParametersInfoA
GetDC
ReleaseDC
GetClassNameA
SendMessageA
DestroyWindow
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
GetMessageA
GetSystemMetrics
wsprintfA
MessageBoxA
GetWindowRect
GetCursorPos
GetActiveWindow
DispatchMessageA
TranslateMessage
PeekMessageA
SetTimer
KillTimer
MoveWindow
SetCursor
LoadCursorA
GetCursor
LoadIconA
SetParent
ShowWindow
FindWindowA
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
UnregisterClassA
gdi32
DeleteDC
SelectObject
GetDeviceCaps
CreateBitmap
SaveDC
RestoreDC
SetBkColor
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetObjectA
GetStockObject
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
shell32
SHGetSpecialFolderPathA
ExtractIconA
ole32
CoUninitialize
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
comctl32
ord17
Sections
.text Size: 828KB - Virtual size: 825KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE