Behavioral task
behavioral1
Sample
cbf80c871a7cbfb9a97fd7665c87b97a110d9c3476790d2fc08ba2ecda7eeb47.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cbf80c871a7cbfb9a97fd7665c87b97a110d9c3476790d2fc08ba2ecda7eeb47.exe
Resource
win10v2004-20220812-en
General
-
Target
cbf80c871a7cbfb9a97fd7665c87b97a110d9c3476790d2fc08ba2ecda7eeb47
-
Size
5.5MB
-
MD5
e082e2dc551fbdbcdb2efc8223509b91
-
SHA1
f86a92c257b00a677b8e8d54847a9d83ab04c149
-
SHA256
cbf80c871a7cbfb9a97fd7665c87b97a110d9c3476790d2fc08ba2ecda7eeb47
-
SHA512
80731b3e33c6dc7a55a5a0fbf74f098700096aae8b12d5d50bbc9f41a489cceaa28d806a85ea637e92520358211e7881154a59a27c60bfc82cd63f0578c16296
-
SSDEEP
98304:k+7sbslfidDzy20ACi5aEYEl6hGMAjsjPU9qwDWIQxeiUBOWOTtIuz9lWaFMC:uKfQDzGUYo6hGMIsjS0/WiIuU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon
Files
-
cbf80c871a7cbfb9a97fd7665c87b97a110d9c3476790d2fc08ba2ecda7eeb47.exe windows x86
d0aaa78e586c231d7497eead187e4b91
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
ReadFile
CreateProcessA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
GetSystemTime
GetLocalTime
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
GetStartupInfoA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
IsBadWritePtr
SetStdHandle
GetExitCodeProcess
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
CreatePipe
GetVolumeInformationA
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetFileAttributesA
SetFilePointer
GetCurrentProcess
GetVersionExA
TerminateProcess
OpenProcess
lstrcpyA
SetLastError
lstrcatA
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
LockResource
LoadResource
FindResourceA
GetTimeZoneInformation
DeviceIoControl
GetVersion
DeleteCriticalSection
GetTickCount
HeapCreate
TerminateThread
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
GlobalDeleteAtom
MulDiv
LocalFree
FlushFileBuffers
LocalAlloc
TlsAlloc
GlobalHandle
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
Sleep
DeleteFileA
WriteFile
GetModuleFileNameA
WritePrivateProfileStringA
GlobalFree
GetUserDefaultLCID
GetPrivateProfileStringA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
GlobalUnlock
GlobalLock
GlobalAlloc
RtlZeroMemory
GetAtomNameW
lstrcpynA
WideCharToMultiByte
WaitForSingleObject
ResumeThread
SuspendThread
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
GetLastError
CreateFileA
HeapDestroy
MultiByteToWideChar
lstrcatW
lstrlenW
lstrcmpA
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
GetProcessHeap
RtlMoveMemory
LocalSize
HeapAlloc
FreeEnvironmentStringsA
TlsFree
user32
SetWindowTextA
GetDlgCtrlID
SetActiveWindow
CreateDialogIndirectParamA
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
PostMessageA
GetWindow
PtInRect
GetWindowLongA
GetWindowTextA
GetCursorPos
SetWindowLongA
SystemParametersInfoA
FindWindowA
GetClassNameA
SendMessageA
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
SendDlgItemMessageA
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
CallWindowProcA
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuW
AppendMenuW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
GetMenuInfo
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
BeginPaint
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetClassLongA
CreateWindowExA
GetMessageW
DrawIconEx
LoadIconW
LoadImageW
CreateIconFromResourceEx
UpdateLayeredWindow
WindowFromDC
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
IsDialogMessageA
EndPaint
TrackMouseEvent
GetDlgItem
GetParent
SetWindowLongW
GetAsyncKeyState
IsWindow
FindWindowExW
GetWindowTextLengthW
GetWindowTextW
GetWindowLongW
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
SetRect
SetWindowRgn
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
UpdateWindow
ValidateRect
ScreenToClient
GetFocus
CopyIcon
GetClassNameW
PostMessageW
ShowWindow
DefWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
ReleaseDC
GetDC
CallWindowProcW
SetFocus
GetNextDlgTabItem
GetAncestor
MapWindowPoints
InvalidateRect
GetWindowThreadProcessId
GetIconInfo
GetWindowRect
SetWindowPos
EnableWindow
IsWindowVisible
IsWindowEnabled
GetSysColor
DestroyAcceleratorTable
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
GetClientRect
SetCursor
DestroyCursor
SendMessageW
GetMenuState
shlwapi
PathRemoveFileSpecW
PathFindFileNameW
gdi32
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
GetDeviceCaps
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetMapMode
RestoreDC
GetObjectA
GetDIBits
CreatePatternBrush
CreateFontIndirectW
GetObjectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
GetTextMetricsA
CreateSolidBrush
GetStockObject
SetBkColor
SetBkMode
SetTextColor
SetViewportOrgEx
DeleteDC
SelectObject
DeleteObject
SaveDC
advapi32
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
StartServiceA
CreateServiceA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
shell32
DragQueryFileW
DragFinish
Shell_NotifyIconW
DragAcceptFiles
CommandLineToArgvW
comctl32
InitCommonControlsEx
ord17
ole32
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CLSIDFromProgID
CoCreateInstance
OleRun
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
gdiplus
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipGetGenericFontFamilySerif
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipPrivateAddMemoryFont
GdipGetSolidFillColor
GdipSetSolidFillColor
GdipCreateSolidFill
GdipGetBrushType
GdipCloneBrush
GdipGetStringFormatMeasurableCharacterRangeCount
GdipSetStringFormatMeasurableCharacterRanges
GdipGetStringFormatDigitSubstitution
GdipSetStringFormatDigitSubstitution
GdipGetStringFormatTabStops
GdipGetStringFormatTabStopCount
GdipSetStringFormatTabStops
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatTrimming
GdipSetStringFormatTrimming
GdipGetStringFormatLineAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipStringFormatGetGenericDefault
GdipCreateStringFormat
GdipDeleteFontFamily
GdiplusStartup
GdipGetGenericFontFamilyMonospace
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipCreateFontFromDC
GdipBitmapUnlockBits
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdipDeleteStringFormat
GdipDisposeImage
GdipDeleteGraphics
msimg32
AlphaBlend
atl
ord42
oledlg
ord8
oleaut32
SafeArrayDestroy
VariantClear
VariantChangeType
VariantInit
SysAllocString
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
netapi32
Netbios
ws2_32
__WSAFDIsSet
inet_addr
htons
WSAStartup
send
connect
WSAGetLastError
ioctlsocket
shutdown
select
socket
inet_ntoa
gethostbyname
closesocket
WSACleanup
recv
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
Sections
.text Size: 448KB - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.9MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.G;W Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VU7 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ