Behavioral task
behavioral1
Sample
9163dfed647ae61c62db070aa1949160N.exe
Resource
win7-20240704-en
General
-
Target
9163dfed647ae61c62db070aa1949160N.exe
-
Size
422KB
-
MD5
9163dfed647ae61c62db070aa1949160
-
SHA1
b7a2b30d2147abeff5dfb9b7e22acc896ca41d30
-
SHA256
bcad3ef22deaa6d2e9a92de3d3dbd7a4f4b9d4cf8f298b7ef43933d28320092c
-
SHA512
8bf8cf809e3424c1fe260d2410dd149eca773148420459cc526e0a0a69e5aab81d20cb3860c21343b6dc9151407c0a0ea6d9b8bc58ccbff003ceb4b90d606771
-
SSDEEP
6144:K5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zIydenC0:K5/Q58drihGiLhmGNiZsx0B/zIkenC0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9163dfed647ae61c62db070aa1949160N.exe
Files
-
9163dfed647ae61c62db070aa1949160N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 72KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE