Behavioral task
behavioral1
Sample
42c18b32054a5e58a165e5e6f800d0a248a002f6b550a2a07d64199e68e11d7b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
42c18b32054a5e58a165e5e6f800d0a248a002f6b550a2a07d64199e68e11d7b.exe
Resource
win10v2004-20240802-en
General
-
Target
42c18b32054a5e58a165e5e6f800d0a248a002f6b550a2a07d64199e68e11d7b
-
Size
909KB
-
MD5
ac1c26f12b2d11f6c3f1f3e5671ca2ec
-
SHA1
4df989e10106714a909976323c783db2c4db4606
-
SHA256
42c18b32054a5e58a165e5e6f800d0a248a002f6b550a2a07d64199e68e11d7b
-
SHA512
d774fcc09318085e1abf02706a6dcbbd3429e5254867e9db6ed3a2ecf420c0341b22ed5bb36e9ebed2895a3e99e832845bbcbd4cf86c776c8aad60d9cb887b8b
-
SSDEEP
24576:ha6ch8Pas17VoQEQRiedNvuCQT7BX6/cou1rgjhTThqJ:h32871Y1cFTlqJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42c18b32054a5e58a165e5e6f800d0a248a002f6b550a2a07d64199e68e11d7b
Files
-
42c18b32054a5e58a165e5e6f800d0a248a002f6b550a2a07d64199e68e11d7b.exe windows:4 windows x86 arch:x86
6a85746e20f19bfe20f60a12e1728afe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
LocalFree
WideCharToMultiByte
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
WaitForSingleObject
LocalAlloc
GetStartupInfoA
SetFilePointer
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetProcAddress
GetModuleHandleA
HeapFree
HeapAlloc
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
lstrlenA
DeleteCriticalSection
CreateProcessA
GetProcessHeap
CreateThread
user32
PeekMessageA
wvsprintfA
MessageBoxA
wsprintfA
DispatchMessageA
GetCursorPos
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SendMessageW
GetMessageA
TranslateMessage
shell32
SHBrowseForFolderW
ShellExecuteA
SHGetPathFromIDListW
SHGetSpecialFolderPathA
ole32
CoTaskMemFree
CoCreateInstance
dbghelp
MakeSureDirectoryPathExists
wininet
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetOpenA
msvcrt
atoi
strstr
malloc
realloc
free
strchr
strrchr
atof
strtod
_atoi64
??2@YAPAXI@Z
sprintf
_ftol
??3@YAXPAX@Z
shlwapi
PathFileExistsA
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
Sections
.text Size: 521KB - Virtual size: 520KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 382KB - Virtual size: 454KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE