Behavioral task
behavioral1
Sample
f1c99de94df2a9ca1f6adf05f8cd6a5c038dc5cc21dd8215d936464308c5f09c.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f1c99de94df2a9ca1f6adf05f8cd6a5c038dc5cc21dd8215d936464308c5f09c.exe
Resource
win10v2004-20240802-en
General
-
Target
f1c99de94df2a9ca1f6adf05f8cd6a5c038dc5cc21dd8215d936464308c5f09c
-
Size
34KB
-
MD5
891b59ede6ec91c27496a5934d77c3fb
-
SHA1
ad9fa906d5afdd71a332c20d88754e420b601258
-
SHA256
f1c99de94df2a9ca1f6adf05f8cd6a5c038dc5cc21dd8215d936464308c5f09c
-
SHA512
cd95ba4a34d4830813a98f3c09fdfef33e8a61640f04f593c003136336e2ca603107d4b7646fc3ce1e70ef141539d2f9ec6038ff247e3ffb5dad76f1fb8bc843
-
SSDEEP
384:wdlX900QFj3ZqyaKIFVQmKHHzLN+ec9BL+Vn85XWb6y1UYQbNp99eCgKKqDE9h3Y:wVQDZqyWCDHPHG+85IvYX9D2I
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1c99de94df2a9ca1f6adf05f8cd6a5c038dc5cc21dd8215d936464308c5f09c
Files
-
f1c99de94df2a9ca1f6adf05f8cd6a5c038dc5cc21dd8215d936464308c5f09c.exe windows:4 windows x86 arch:x86
47252d68d4bc15d699a8ae27b6ad35c1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
GetDateFormatA
GetTimeFormatA
GetLocalTime
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
lstrlenW
GetCommandLineW
GetModuleFileNameA
CloseHandle
WriteFile
CreateFileA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetTickCount
LocalFree
GetCurrentProcessId
user32
PeekMessageA
GetMessageA
IsWindowVisible
wsprintfA
MessageBoxA
GetWindowTextW
GetWindowTextLengthW
GetClassNameA
GetParent
DispatchMessageA
GetWindowThreadProcessId
FindWindowExA
MessageBoxTimeoutA
TranslateMessage
oleaut32
VariantTimeToSystemTime
msvcrt
strchr
__CxxFrameHandler
??3@YAXPAX@Z
sprintf
atoi
strncpy
strncmp
??2@YAPAXI@Z
_ftol
modf
strrchr
free
memmove
malloc
shell32
CommandLineToArgvW
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE