Behavioral task
behavioral1
Sample
b902b5a576aa1e97be253eb328a9e019874e2d1a6ef2c740b8698ecd62ab2d31.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b902b5a576aa1e97be253eb328a9e019874e2d1a6ef2c740b8698ecd62ab2d31.exe
Resource
win10v2004-20240802-en
General
-
Target
b902b5a576aa1e97be253eb328a9e019874e2d1a6ef2c740b8698ecd62ab2d31
-
Size
930KB
-
MD5
5b81c27f1168d4cbc4d6d7a28875c9bc
-
SHA1
27c235791b9b4bc3d4c41e9653e728358c23dd6a
-
SHA256
b902b5a576aa1e97be253eb328a9e019874e2d1a6ef2c740b8698ecd62ab2d31
-
SHA512
e7f7d25f71b1a2bb0422fd883a95ca4cc2ae5de7444c5127d0f0915c375ef2d21870c9361b0b82421b49382a1337b714b666d114e00e19d82d00cd47ad3ca395
-
SSDEEP
24576:rSdsJmIp+aDqCLrKbt5b8ABX6/cou1rgjhTThqJ:rCAY1cFTlqJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b902b5a576aa1e97be253eb328a9e019874e2d1a6ef2c740b8698ecd62ab2d31
Files
-
b902b5a576aa1e97be253eb328a9e019874e2d1a6ef2c740b8698ecd62ab2d31.exe windows:4 windows x86 arch:x86
5374b35c62626a73251e6b2c8c17adee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
LocalFree
WideCharToMultiByte
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RtlMoveMemory
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
WaitForSingleObject
LocalAlloc
GetStartupInfoA
SetFilePointer
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
HeapFree
HeapAlloc
GetProcessHeap
GetModuleHandleA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
lstrlenA
DeleteCriticalSection
GetProcAddress
CreateProcessA
CreateThread
user32
SendMessageW
wvsprintfA
MessageBoxA
wsprintfA
DispatchMessageA
GetCursorPos
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PeekMessageA
GetMessageA
TranslateMessage
shell32
SHBrowseForFolderW
ShellExecuteA
SHGetPathFromIDListW
SHGetSpecialFolderPathA
ole32
CoTaskMemFree
CoCreateInstance
dbghelp
MakeSureDirectoryPathExists
wininet
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
msvcrt
atoi
strstr
malloc
realloc
free
strchr
strrchr
atof
strtod
_atoi64
??2@YAPAXI@Z
sprintf
_ftol
??3@YAXPAX@Z
shlwapi
PathFileExistsA
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
Sections
.text Size: 535KB - Virtual size: 535KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 381KB - Virtual size: 454KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE