Behavioral task
behavioral1
Sample
5a4999233f9c88b4de472b2ffd2a3900N.exe
Resource
win7-20240903-en
General
-
Target
5a4999233f9c88b4de472b2ffd2a3900N.exe
-
Size
304KB
-
MD5
5a4999233f9c88b4de472b2ffd2a3900
-
SHA1
a14af350e4ae8c5fbc1690ce5d3d5dcf3a85a43d
-
SHA256
5d6e67ce755a08e54ce7c994244560beb0dc6e2b25717728e493afac7c9cbae8
-
SHA512
01a94f01c6794acadb4492e1cac5d75e1ddb3dc1b60e30f2a2b273d178dc8d967ac020b8376079bebba5234df742bc53f6b9fac9c8ce3f75539a9fa01f79487e
-
SSDEEP
3072:cp7sopjh6E1M4bI58XAxFtttttttttttttu8:Avjhb1M4bk8QvtttttttttttttT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a4999233f9c88b4de472b2ffd2a3900N.exe
Files
-
5a4999233f9c88b4de472b2ffd2a3900N.exe.exe windows:4 windows x86 arch:x86
4c014f2429f67ef5747809820c0ee0a7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
CloseHandle
Process32Next
OpenProcess
lstrcpyn
RtlMoveMemory
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
GetModuleHandleA
FindResourceA
SizeofResource
LoadResource
LockResource
lstrcatA
GetCurrentThreadId
GetProcessHeap
ExitProcess
HeapAlloc
CreateToolhelp32Snapshot
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
Sleep
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
TerminateThread
DeleteCriticalSection
CreateThread
CreateProcessA
CreateEventA
HeapReAlloc
OpenEventA
comdlg32
GetOpenFileNameA
gdi32
DeleteObject
msvcrt
_strnicmp
malloc
free
memmove
modf
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
atoi
_ftol
strncpy
strncmp
floor
_CIfmod
__CxxFrameHandler
tolower
_CIpow
strrchr
strchr
shell32
ShellExecuteA
shlwapi
PathFileExistsA
user32
GetSystemMetrics
GetMessageA
TranslateMessage
DispatchMessageA
GetWindowLongA
MessageBoxA
GetFocus
SetFocus
AttachThreadInput
MoveWindow
EnableWindow
IsWindowEnabled
MessageBoxTimeoutA
wsprintfA
GetWindowThreadProcessId
IsWindowVisible
EnumChildWindows
CallWindowProcA
CopyImage
ShowWindow
PeekMessageA
Sections
UPX0 Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE