blackmoon | 7198ad58ef0604428eb13a4257f09bc561b41ebf252b9a367c3a2b095c19d8ae

Sharing

Copy URL Twitter E-mail

General

Target

7198ad58ef0604428eb13a4257f09bc561b41ebf252b9a367c3a2b095c19d8ae
Size

13.4MB
MD5

54ae6977a79e569a968c41f1b2a8b3bd
SHA1

fbda70994667123b1367c75778f7cd20e0fe8971
SHA256

7198ad58ef0604428eb13a4257f09bc561b41ebf252b9a367c3a2b095c19d8ae
SHA512

a028e2d855d09e15fcb1d9bc21bc226bc9b2345c04e8c53cccaf13f812663e32a9b20ca0011f584cff8a408522ac82caac93a432abfa1b7dc302cb45d6eaff51
SSDEEP

196608:oAIVhRsIKK8XDE0R68liB92UlU2uwpZYtCCtGhGBjeSLa7FpaRke+:odh2IQE0jis2hS7Nje69t+

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7198ad58ef0604428eb13a4257f09bc561b41ebf252b9a367c3a2b095c19d8ae

Files

7198ad58ef0604428eb13a4257f09bc561b41ebf252b9a367c3a2b095c19d8ae
.exe windows x86

eb64101b77006d77ae1b71a3f7e155b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
WideCharToMultiByte
GetProcessHeap
HeapAlloc
LocalSize
RtlMoveMemory
InterlockedIncrement
InterlockedDecrement
HeapFree
lstrlenW
lstrcmpA
lstrcmpiW
lstrcatW
MultiByteToWideChar
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW
GetAtomNameW
HeapCreate
HeapDestroy
lstrcmpiA
RtlZeroMemory
lstrcmpW
LocalAlloc
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
lstrcpyA
lstrcatA
MulDiv
GlobalAlloc
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
GetTickCount
WritePrivateProfileStringA
SetEndOfFile
SetFilePointer
WriteFile
GlobalFree
GetUserDefaultLCID
CreateFileA
GetFileSize
ReadFile
GetModuleFileNameA
GetPrivateProfileStringA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
GlobalUnlock
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrlenA
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
CloseHandle
TerminateThread
GlobalLock
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
FlushFileBuffers
LocalFree
TlsAlloc
DeleteCriticalSection
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
lstrcpynA
GlobalFlags
SetLastError
GetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
LockResource
LoadResource
FindResourceA
GetProcessVersion
SetErrorMode
GetCurrentProcess
CreateThread

user32

GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
InvalidateRect
FillRect
GetNextDlgTabItem
SetFocus
GetDC
DrawTextA
ReleaseDC
OffsetRect
DefWindowProcW
GetWindowDC
ClientToScreen
GetFocus
GetMessageW
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
ShowWindow
PostMessageW
CopyIcon
GetIconInfo
ScreenToClient
ValidateRect
UpdateWindow
MoveWindow
SetParent
SetWindowTextW
MessageBoxW
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
DrawIconEx
CreateMenu
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
SetActiveWindow
AdjustWindowRectEx
CopyRect
DestroyAcceleratorTable
DestroyCursor
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetClassLongA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
TabbedTextOutA
UnhookWindowsHookEx
GetWindowTextA
SetWindowTextA
GetWindow
GetDlgCtrlID
PtInRect
GetClassNameA
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
PostMessageA
UnregisterHotKey
SetWindowLongA
SendMessageA
RegisterHotKey
LoadBitmapA
GetCursorPos
CreateWindowExA
CallWindowProcA
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
GetClientRect
SetCursor
SetMenuDefaultItem
LoadStringW
CharUpperW
CharLowerW
MessageBoxA
wsprintfA
FindWindowA
MsgWaitForMultipleObjects
DispatchMessageA
GetMessageA
PeekMessageA
SendMessageW
GetWindowLongW
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetParent
IsWindow
GetAsyncKeyState
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
GetWindowTextW

gdi32

GetObjectA
GetDIBits
CreatePatternBrush
CreateEllipticRgn
CreateFontIndirectW
GetObjectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
CreateFontA
GetDeviceCaps
TranslateCharsetInfo
CreateBitmap
SaveDC
CreateSolidBrush
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible

advapi32

CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptAcquireContextA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA

comctl32

InitCommonControlsEx
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17

shell32

CommandLineToArgvW
Shell_NotifyIconW
DragFinish
DragQueryFileA
DragQueryFileW
ShellExecuteEx
DragAcceptFiles

ole32

CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
StringFromGUID2
CLSIDFromString
OleRun
CoCreateInstance
CLSIDFromProgID
GetHGlobalFromStream

wininet

HttpQueryInfoA
InternetSetCookieA
InternetCloseHandle
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetReadFile

oleaut32

SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantInit
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
SafeArrayDestroyDescriptor

gdiplus

GdipDeletePath
GdipDeleteRegion
GdipCreateImageAttributes
GdipCloneImageAttributes
GdipSetImageAttributesToIdentity
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesRemapTable
GdipSetImageAttributesWrapMode
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesColorMatrix
GdipGetPathLastPoint
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipFlush
GdipGetDC
GdipReleaseDC
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetWorldTransform
GdipGetWorldTransform
GdipDeleteMatrix
GdipResetWorldTransform
GdipResetImageAttributes
GdipSetImageAttributesThreshold
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipSetPageUnit
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipDeleteFont
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipSetImageAttributesNoOp
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPageUnit
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdiplusStartup
GdipDisposeImage
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipCreateTexture
GdipFillRectangle
GdipIsOutlineVisiblePathPoint
GdipSetImageAttributesOutputChannel
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipSetImageAttributesGamma
GdipFlattenPath
GdipSetImageAttributesColorKeys
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipDeleteBrush
GdipSetPageScale

atl

ord42

shlwapi

wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntExW

crypt32

CryptStringToBinaryW

uxtheme

SetWindowTheme

msimg32

AlphaBlend

oledlg

ord8

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

Sections

.text
Size: 544KB - Virtual size: 541KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12.8MB - Virtual size: 12.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb64101b77006d77ae1b71a3f7e155b2

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

shell32

ole32

wininet

oleaut32

gdiplus

atl

shlwapi

crypt32

uxtheme

msimg32

oledlg

winspool.drv

Sections

.text Size: 544KB - Virtual size: 541KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 12.8MB - Virtual size: 12.9MB

.rsrc Size: 4KB - Virtual size: 664B

.text
Size: 544KB - Virtual size: 541KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 12.8MB - Virtual size: 12.9MB

.rsrc
Size: 4KB - Virtual size: 664B