Behavioral task
behavioral1
Sample
6779004441fa45869d13d144e118e2fe25488bc2f1b1c3b1afa87ea681389619.exe
Resource
win7-20240704-en
General
-
Target
6779004441fa45869d13d144e118e2fe25488bc2f1b1c3b1afa87ea681389619
-
Size
441KB
-
MD5
a1ed015f525678cc1aab6faee85507b4
-
SHA1
4d8afa80d0a0b8aca1944687e2ae50fb7ebe8257
-
SHA256
6779004441fa45869d13d144e118e2fe25488bc2f1b1c3b1afa87ea681389619
-
SHA512
d7cb989f10aa2c754434d2cbf1eff0aa684af3509e7eb500dc4573c54766c3a4bc001e27c9e222d496dddb0efa615bb2b1198e3be4431aad4de13f5c384399dd
-
SSDEEP
6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAX:xgXQKSLpOCtV0R8xMSaAX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6779004441fa45869d13d144e118e2fe25488bc2f1b1c3b1afa87ea681389619
Files
-
6779004441fa45869d13d144e118e2fe25488bc2f1b1c3b1afa87ea681389619.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 391KB - Virtual size: 390KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE