Behavioral task
behavioral1
Sample
c483df38ffdbf0ce5d596a6b47631a8bf62852c16bdcb209dcfd6a8ea972ed12.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c483df38ffdbf0ce5d596a6b47631a8bf62852c16bdcb209dcfd6a8ea972ed12.exe
Resource
win10v2004-20240802-en
General
-
Target
c483df38ffdbf0ce5d596a6b47631a8bf62852c16bdcb209dcfd6a8ea972ed12
-
Size
52KB
-
MD5
90b7dcb22ad4e288e7756ce0dd58b3e8
-
SHA1
7177dc760a31eea0e547213d0a1fe93b92cffa7c
-
SHA256
c483df38ffdbf0ce5d596a6b47631a8bf62852c16bdcb209dcfd6a8ea972ed12
-
SHA512
d9b8c51f8e54a2b4f32708d6795ab116f1263cc38f39925793f1ecd72549cc41297e1ea38dd93ed274fa79d40a0ec20427fd4b2a9eafafde44199a984a212a93
-
SSDEEP
768:5uJvrJYvbIV+TQTCdmTG55HDLsqmU01Fw8ts5F/axPi:5u5rnVvGmxxJFw8UFN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c483df38ffdbf0ce5d596a6b47631a8bf62852c16bdcb209dcfd6a8ea972ed12
Files
-
c483df38ffdbf0ce5d596a6b47631a8bf62852c16bdcb209dcfd6a8ea972ed12.exe windows:4 windows x86 arch:x86
e146922a11411e0bf7abeabae1a0441d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
LCMapStringA
ReadFile
GetModuleFileNameA
CreateFileA
LeaveCriticalSection
EnterCriticalSection
MoveFileA
WriteFile
CloseHandle
DeleteFileA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetModuleHandleA
GetEnvironmentVariableA
DeleteCriticalSection
GetFileSize
InitializeCriticalSection
user32
wvsprintfA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
EnableWindow
GetParent
IsWindowEnabled
GetForegroundWindow
IsWindow
GetActiveWindow
SetActiveWindow
SetForegroundWindow
wsprintfA
MessageBoxA
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
ws2_32
WSAStartup
socket
htons
inet_addr
connect
closesocket
send
recv
WSACleanup
msvcrt
??2@YAPAXI@Z
sprintf
__CxxFrameHandler
free
malloc
atoi
_ftol
modf
realloc
memmove
strncmp
??3@YAXPAX@Z
strrchr
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ