Behavioral task
behavioral1
Sample
c8e55d1f4a795b0d8a6fe4495fbca28df6b7228d980568ab61e1d83e406b540e.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c8e55d1f4a795b0d8a6fe4495fbca28df6b7228d980568ab61e1d83e406b540e.dll
Resource
win10v2004-20241007-en
General
-
Target
c8e55d1f4a795b0d8a6fe4495fbca28df6b7228d980568ab61e1d83e406b540e.exe
-
Size
2.9MB
-
MD5
36f179858e852211879b71d34b293787
-
SHA1
a9a7a870bc91fbfe819edb77e11950d261197c51
-
SHA256
c8e55d1f4a795b0d8a6fe4495fbca28df6b7228d980568ab61e1d83e406b540e
-
SHA512
a5c69a4fffe82190635008acf82c392e8d6de8597c03f13f950b480e3baeecce911b15f0ac8359d896c7da9b34a29ecfc49b8a99b73ce8140ceed2a382e473a8
-
SSDEEP
49152:0Y6LfuhifICeZNZfNpNT+3/lGFi7YtXyCbJXPqEAQ2wQrtJmzys2gzy:iLb3ejZg3NGQ7YACbStwQrtGy2zy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8e55d1f4a795b0d8a6fe4495fbca28df6b7228d980568ab61e1d83e406b540e.exe
Files
-
c8e55d1f4a795b0d8a6fe4495fbca28df6b7228d980568ab61e1d83e406b540e.exe.dll windows:4 windows x86 arch:x86
0e6526b20a130e1667c41d56e6a8c85d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
timeGetTime
kernel32
VirtualAlloc
VirtualProtect
GetModuleHandleA
GetProcAddress
IsBadReadPtr
GetCurrentThreadId
RtlMoveMemory
MultiByteToWideChar
WideCharToMultiByte
VirtualProtectEx
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
DeleteFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetTickCount
GetCommandLineA
GetModuleFileNameA
LoadLibraryA
LCMapStringA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
FreeLibrary
TlsSetValue
GetOEMCP
GetACP
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
RaiseException
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetFilePointer
LCMapStringW
GetCPInfo
user32
SetTimer
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
SetWindowsHookExA
GetWindowLongA
GetWindowTextA
KillTimer
CallNextHookEx
GetAsyncKeyState
SetWinEventHook
psapi
GetModuleInformation
Sections
.text Size: 180KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ