Behavioral task
behavioral1
Sample
e535a3fe6a003a36504956f89c31bd5a8d1ff58d412626858da8393b8fce7786.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e535a3fe6a003a36504956f89c31bd5a8d1ff58d412626858da8393b8fce7786.exe
Resource
win10v2004-20240802-en
General
-
Target
e535a3fe6a003a36504956f89c31bd5a8d1ff58d412626858da8393b8fce7786
-
Size
52KB
-
MD5
57ef1ce3412eba6a7a3a7d497a0470ec
-
SHA1
d528e968bd71fce67cb396f3783ef737772c958d
-
SHA256
e535a3fe6a003a36504956f89c31bd5a8d1ff58d412626858da8393b8fce7786
-
SHA512
62bf73c7c501124cef67f47ccb58410cfc377ddd9aad1de5a1215f42ee1bb9521b595b43dabc2f953c02105e5ab4a06650b2a0f851b7a589643b687df09603bb
-
SSDEEP
768:5uJvrJYvbIV+TQTCdmTG55HDLsqmU01Fw8ts5F/YxPi:5u5rnVvGmxxJFw8UFn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e535a3fe6a003a36504956f89c31bd5a8d1ff58d412626858da8393b8fce7786
Files
-
e535a3fe6a003a36504956f89c31bd5a8d1ff58d412626858da8393b8fce7786.exe windows:4 windows x86 arch:x86
e146922a11411e0bf7abeabae1a0441d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
LCMapStringA
ReadFile
GetModuleFileNameA
CreateFileA
LeaveCriticalSection
EnterCriticalSection
MoveFileA
WriteFile
CloseHandle
DeleteFileA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetModuleHandleA
GetEnvironmentVariableA
DeleteCriticalSection
GetFileSize
InitializeCriticalSection
user32
wvsprintfA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
EnableWindow
GetParent
IsWindowEnabled
GetForegroundWindow
IsWindow
GetActiveWindow
SetActiveWindow
SetForegroundWindow
wsprintfA
MessageBoxA
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
ws2_32
WSAStartup
socket
htons
inet_addr
connect
closesocket
send
recv
WSACleanup
msvcrt
??2@YAPAXI@Z
sprintf
__CxxFrameHandler
free
malloc
atoi
_ftol
modf
realloc
memmove
strncmp
??3@YAXPAX@Z
strrchr
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ