Behavioral task
behavioral1
Sample
f291b64b2d717b8e4e84bd69177311ea5745d46cbb632522b4d7eb7ccde6e9de.exe
Resource
win7-20240704-en
General
-
Target
f291b64b2d717b8e4e84bd69177311ea5745d46cbb632522b4d7eb7ccde6e9de
-
Size
902KB
-
MD5
893ff5cecb513321c6deeaaeda00ec5c
-
SHA1
4417e5c4ba86d79c021191525adb056544217e5d
-
SHA256
f291b64b2d717b8e4e84bd69177311ea5745d46cbb632522b4d7eb7ccde6e9de
-
SHA512
d0309f0fccc2845552551b1c0488f81621bbe08a5361c2a8661a88cf77599b5e96cc32e794ca21047a6ff573ff3d1ea5b230054d561db6f6aa90a7eb0c444e99
-
SSDEEP
24576:FAZ13OyTgtgCdZn30uCGuoF1mVyYA3+I5G:mZux0yR33
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f291b64b2d717b8e4e84bd69177311ea5745d46cbb632522b4d7eb7ccde6e9de
Files
-
f291b64b2d717b8e4e84bd69177311ea5745d46cbb632522b4d7eb7ccde6e9de.exe windows:4 windows x86 arch:x86
2d7841e8c2f5260834b4957568fd572f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
WriteFile
ExitProcess
GetCommState
BuildCommDCBA
SetCommState
SetCommTimeouts
GetProcessHeap
GetModuleHandleA
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
MultiByteToWideChar
WritePrivateProfileStringA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CreateThread
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
GetTickCount
GetStdHandle
SetConsoleTitleA
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetSystemMetrics
MessageBoxA
mouse_event
GetAsyncKeyState
wsprintfA
msvcrt
srand
rand
atoi
_ftol
_CIfmod
strncpy
_CIpow
atof
strrchr
strchr
modf
malloc
free
memmove
strncmp
__CxxFrameHandler
printf
strstr
??3@YAXPAX@Z
sprintf
??2@YAPAXI@Z
_strdup
shlwapi
PathFileExistsA
Sections
.text Size: 324KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 574KB - Virtual size: 635KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE