Behavioral task
behavioral1
Sample
8c6d3bf3629975fccadbd21d3396879ea8bee6fd21b086d329f51b2cb2f71918.exe
Resource
win7-20240903-en
General
-
Target
8c6d3bf3629975fccadbd21d3396879ea8bee6fd21b086d329f51b2cb2f71918.exe
-
Size
13.6MB
-
MD5
a46ad13e35167f886a624e60c897aeba
-
SHA1
5b5139619b9d22ef17467ebb7d22ab7b0ce346cd
-
SHA256
8c6d3bf3629975fccadbd21d3396879ea8bee6fd21b086d329f51b2cb2f71918
-
SHA512
3133d632bf7cf10a33b07c2f947b99859c9c67e24174c752791a25f95b287420397d4c7d01c0d86c988b05fe98b7fb43dd4c2a78a292e23a04d818c6512354cb
-
SSDEEP
393216:8u1L+YuY+Yiu1L+YuY+Ywu1L+YuY+Yiu1L+YuY+Yj:X
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
Processes:
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 8c6d3bf3629975fccadbd21d3396879ea8bee6fd21b086d329f51b2cb2f71918.exe
Files
-
8c6d3bf3629975fccadbd21d3396879ea8bee6fd21b086d329f51b2cb2f71918.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 292KB - Virtual size: 290KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE