Behavioral task
behavioral1
Sample
e70d872e20daf5849164d69e6ce7daee0459e5d14c066e2ac3d4c746332702dc.exe
Resource
win7-20240704-en
General
-
Target
e70d872e20daf5849164d69e6ce7daee0459e5d14c066e2ac3d4c746332702dc
-
Size
902KB
-
MD5
602a1d74ca2d198e954bd75be38813d0
-
SHA1
b35dc560c3f682936e40b19caa25b83b917df3bc
-
SHA256
e70d872e20daf5849164d69e6ce7daee0459e5d14c066e2ac3d4c746332702dc
-
SHA512
1b9567ba0366b48bb2641ab2b65610fb637ef792389861ef3d02b491dabc041db86aac55a9d80bc78dc7b20628be1816ff737a81d9cb0622cfb34c70c2325929
-
SSDEEP
24576:FAh5KqEXpHF2xWNY/gCdZn30uCGuoF1mVyYA3+I5W:mhLXx0yR33
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e70d872e20daf5849164d69e6ce7daee0459e5d14c066e2ac3d4c746332702dc
Files
-
e70d872e20daf5849164d69e6ce7daee0459e5d14c066e2ac3d4c746332702dc.exe windows:4 windows x86 arch:x86
2d7841e8c2f5260834b4957568fd572f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
WriteFile
ExitProcess
GetCommState
BuildCommDCBA
SetCommState
SetCommTimeouts
GetProcessHeap
GetModuleHandleA
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
MultiByteToWideChar
WritePrivateProfileStringA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CreateThread
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
GetTickCount
GetStdHandle
SetConsoleTitleA
user32
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetSystemMetrics
MessageBoxA
mouse_event
GetAsyncKeyState
wsprintfA
msvcrt
srand
rand
atoi
_ftol
_CIfmod
strncpy
_CIpow
atof
strrchr
strchr
modf
malloc
free
memmove
strncmp
__CxxFrameHandler
printf
strstr
??3@YAXPAX@Z
sprintf
??2@YAPAXI@Z
_strdup
shlwapi
PathFileExistsA
Sections
.text Size: 324KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 574KB - Virtual size: 635KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE