blackmoon | 4b81f6a986387e49d086fd2a7e773ec311fea97fa84ca483d03d825c235fa674

General

Target

4b81f6a986387e49d086fd2a7e773ec311fea97fa84ca483d03d825c235fa674
Size

86KB
MD5

8460e97b918bcee683c683b17fa70860
SHA1

85a49461f9586ac27dc52ceb89b948fd8d4ebd08
SHA256

4b81f6a986387e49d086fd2a7e773ec311fea97fa84ca483d03d825c235fa674
SHA512

92e0220528c6829e0d273521855647c4e0f7c58292a4589e315c3c5cd46bba161bbc4a1bd99ca65f4a037757599b1a4f79e7404544bc868a87a8e56f2d8363b2
SSDEEP

768:Tc5tW1+S9VilFfQDdOHq2BBCX8aeUDn5Kl3Y77WZKEV6FKb3/w+dMc44+YZkJo/w:g56izfmdOK2BvUD5Klo3MKiPPMcNF

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

4b81f6a986387e49d086fd2a7e773ec311fea97fa84ca483d03d825c235fa674
.exe windows x86

58f3944e86e5374b2fa222aa235e757f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

sprintf
strncmp
strncpy
malloc
free
modf
_ftol
strrchr
??3@YAXPAX@Z
??2@YAPAXI@Z
_CIpow
strtod
tolower

user32

MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
KillTimer
SetTimer

kernel32

LCMapStringA
GetModuleFileNameA
GetCommandLineA
CreateFileA
WriteFile
WideCharToMultiByte
MultiByteToWideChar
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
CloseHandle
SetWaitableTimer
CreateWaitableTimerA

ole32

CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize

oleaut32

VariantChangeType
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
RegisterTypeLi
LoadTypeLi
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
VariantInit
SafeArrayGetUBound

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

58f3944e86e5374b2fa222aa235e757f

Headers

File Characteristics

Imports

msvcrt

user32

kernel32

ole32

oleaut32

Sections

.text Size: 24KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 1KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 1KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 3KB