Behavioral task
behavioral1
Sample
48e4d205c99fbaafb8f925a9f7d09eee47f4a95c414ab2321d5f0ec99eb8d3ad.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
48e4d205c99fbaafb8f925a9f7d09eee47f4a95c414ab2321d5f0ec99eb8d3ad.exe
Resource
win10v2004-20240802-en
General
-
Target
48e4d205c99fbaafb8f925a9f7d09eee47f4a95c414ab2321d5f0ec99eb8d3ad
-
Size
11.2MB
-
MD5
be789ccd35f60d27e6ab3058c31c1b3d
-
SHA1
6b0eae58c23d40afbd01730d6b6ae5bc4528b25c
-
SHA256
48e4d205c99fbaafb8f925a9f7d09eee47f4a95c414ab2321d5f0ec99eb8d3ad
-
SHA512
c0d2d1a971cce1dceea7a4e25cce5cae69046974d86493c85e9043e7a00fbe872b10e5c240ef1212a1d9be69966bf352c2cff271b5186e89abc23e9e280ea480
-
SSDEEP
196608:EKAdmHvZPLp8ktRyPJfy6+kJu6e8+ZfHtBhIgNAVo:SmHvhYftJre8+ZfHtcg5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48e4d205c99fbaafb8f925a9f7d09eee47f4a95c414ab2321d5f0ec99eb8d3ad
Files
-
48e4d205c99fbaafb8f925a9f7d09eee47f4a95c414ab2321d5f0ec99eb8d3ad.exe windows:4 windows x86 arch:x86
8d84add98667ba6de402fab9d65d70e8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
FreeLibrary
GetProcAddress
LoadLibraryA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
RaiseException
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers
user32
MessageBoxA
wsprintfA
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11.1MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ