Behavioral task
behavioral1
Sample
a8b24906dcb09c3b15b2e3424fd2afbcc01013a651d44cf47fa02df9d0182371.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a8b24906dcb09c3b15b2e3424fd2afbcc01013a651d44cf47fa02df9d0182371.exe
Resource
win10v2004-20240802-en
General
-
Target
a8b24906dcb09c3b15b2e3424fd2afbcc01013a651d44cf47fa02df9d0182371
-
Size
899KB
-
MD5
c259d7590d0e10cbf78ea10ce28bdeaa
-
SHA1
836223bdf1b9151d9cc4cce4eb966b916796fd35
-
SHA256
a8b24906dcb09c3b15b2e3424fd2afbcc01013a651d44cf47fa02df9d0182371
-
SHA512
752eb0cd8b7a0688425b1e422c43aadd24297c8a312c344f2696df30073a8a7cc27d04748f3e986fd0ce6645ce0370df9c4d3e1f2ca27cf6cb1cc64b61b5ddbf
-
SSDEEP
24576:tK/3W4Ok9cOyumvpaBX6/cou1rgjhTThqJ:tnY1cFTlqJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8b24906dcb09c3b15b2e3424fd2afbcc01013a651d44cf47fa02df9d0182371
Files
-
a8b24906dcb09c3b15b2e3424fd2afbcc01013a651d44cf47fa02df9d0182371.exe windows:4 windows x86 arch:x86
4e07d73ee694e6f4acb3e6dbc9fd488a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
LocalFree
WideCharToMultiByte
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
WaitForSingleObject
LocalAlloc
GetStartupInfoA
SetFilePointer
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetProcAddress
GetModuleHandleA
HeapFree
HeapAlloc
DeleteCriticalSection
CreateProcessA
GetProcessHeap
CreateThread
user32
PeekMessageA
wvsprintfA
MessageBoxA
wsprintfA
DispatchMessageA
GetCursorPos
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SendMessageW
GetMessageA
TranslateMessage
shell32
SHBrowseForFolderW
ShellExecuteA
SHGetPathFromIDListW
ole32
CoTaskMemFree
dbghelp
MakeSureDirectoryPathExists
wininet
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetOpenA
msvcrt
atoi
strstr
malloc
realloc
free
strchr
strrchr
atof
strtod
_atoi64
??2@YAPAXI@Z
sprintf
_ftol
??3@YAXPAX@Z
shlwapi
PathFileExistsA
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 381KB - Virtual size: 453KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE