blackmoon | 79b4162bb00ab6d703639aa8ef51f80fc641f5b35320622be2c5868bebf84353

Sharing

Copy URL Twitter E-mail

General

Target

79b4162bb00ab6d703639aa8ef51f80fc641f5b35320622be2c5868bebf84353
Size

11.5MB
MD5

ec914638c8adb6cac702c8612c3410a9
SHA1

dab6bc17da7ea4ad08d6a05130d6ca68e1bf03b1
SHA256

79b4162bb00ab6d703639aa8ef51f80fc641f5b35320622be2c5868bebf84353
SHA512

0c890dd7fe44e9aec430e67daa9faf4318d251c02425486d7f42c6ab6e28faa2fa483f66325cfe8ee1cbb53956753d9fa4984d627075f89c83f628a940d1de32
SSDEEP

196608:Ddli2XykeihBWeFXy+IFTYMjcg0+JNNc1ZrLWk5+WmW4sA:aNHcBWeFXOlRjv0+J69LWk1mH

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79b4162bb00ab6d703639aa8ef51f80fc641f5b35320622be2c5868bebf84353

Files

79b4162bb00ab6d703639aa8ef51f80fc641f5b35320622be2c5868bebf84353
.exe windows x86

2e30ed92fbc97beb2965b6368568a6f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
DeviceIoControl
CreateFileA
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleHandleA
ExitProcess
HeapReAlloc
lstrcmpA
lstrcmpiW
lstrcatW
MultiByteToWideChar
GetModuleHandleW
GetCommandLineW
WideCharToMultiByte
GetModuleFileNameW
GetAtomNameW
HeapCreate
SetEnvironmentVariableA
lstrlenW
CompareStringA
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
lstrcmpW
IsBadWritePtr
VirtualAlloc
VirtualFree
GetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
HeapSize
GetACP
GetSystemTime
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
TlsGetValue
LocalReAlloc
LCMapStringA
FreeLibrary
GetCommandLineA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
SetFileAttributesA
GlobalFree
WriteFile
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetTickCount
GetModuleFileNameA
WritePrivateProfileStringA
GetLocalTime
GetPrivateProfileStringA
RtlZeroMemory
lstrcmpiA
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
GetProcessHeap
GetProcAddress
RtlMoveMemory
LoadLibraryA
VirtualAllocEx
TerminateProcess
OpenProcess
MoveFileA
CreateDirectoryA
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
FlushFileBuffers
SetFilePointer
LocalAlloc
lstrcpynA
LocalFree
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
lstrcpyA
lstrcatA
MulDiv
GetCurrentProcess
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
SetLastError
GetTimeZoneInformation
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
Sleep
LCMapStringW
HeapDestroy
GlobalSize
CompareStringW
IsBadReadPtr

user32

SetParent
SetWindowTextW
MessageBoxW
SetTimer
KillTimer
SetPropW
SetPropA
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetClassLongA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
TabbedTextOutA
UnhookWindowsHookEx
GetWindow
GetDlgCtrlID
UpdateWindow
GetClassNameA
GetWindowTextA
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
CreateMDIWindowW
SetMenuItemBitmaps
EnableMenuItem
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
PostMessageA
UnregisterHotKey
SetWindowLongA
SendMessageA
RegisterHotKey
LoadBitmapA
CreateWindowExA
CallWindowProcA
SetActiveWindow
GetActiveWindow
GetForegroundWindow
SetWindowTextA
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
DrawIconEx
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
ValidateRect
ScreenToClient
GetIconInfo
CopyIcon
PostMessageW
ShowWindow
PtInRect
CallWindowProcW
GetMenuItemCount
GetMenuItemInfoW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
AppendMenuW
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetMessageW
GetFocus
ClientToScreen
FillRect
GetWindowDC
DefWindowProcW
OffsetRect
ReleaseDC
DrawTextA
GetDC
SetFocus
GetNextDlgTabItem
InvalidateRect
GetWindowRect
SetWindowPos
EnableWindow
IsWindowEnabled
IsWindowVisible
GetSysColor
DestroyAcceleratorTable
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
SetCursor
DestroyCursor
SendMessageW
GetWindowLongW
GetParent
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
FindWindowExW
GetAsyncKeyState
SetWindowLongW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
LoadStringW
CharUpperW
CharLowerW
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
FindWindowA
BeginPaint
SetWindowRgn
IsWindow
MsgWaitForMultipleObjects
GetClientRect
GetCursorPos
MoveWindow
GetWindowThreadProcessId
ModifyMenuA

gdi32

ScaleViewportExtEx
GetObjectA
GetDIBits
CreatePatternBrush
CreateEllipticRgn
CreateFontIndirectW
GetObjectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
CreateSolidBrush
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
CreateFontA
GetDeviceCaps
TranslateCharsetInfo
CreateBitmap
SaveDC
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible

comctl32

ImageList_Destroy
InitCommonControlsEx
ImageList_EndDrag
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ord17
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
CreateServiceA
OpenSCManagerA
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegOpenKeyExA

shell32

DragQueryFileW
DragFinish
Shell_NotifyIconW
CommandLineToArgvW
DragQueryFileA
SHGetSpecialFolderPathA
DragAcceptFiles

ole32

CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard

gdiplus

GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipSetPageUnit
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipIsMatrixInvertible
GdipGetFontHeight
GdipGetFontUnit
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipGetFontHeightGivenDPI
GdipCreateBitmapFromFile
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipCreateSolidFill
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetFontStyle
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdiplusStartup
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipCreateTexture
GdipFillRectangle
GdipGetFontSize
GdipDeleteBrush
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipMultiplyMatrix

atl

ord42

shlwapi

StrToIntExW
wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsA

crypt32

CryptStringToBinaryW

msimg32

AlphaBlend

oledlg

ord8

rasapi32

RasGetConnectStatusA
RasHangUpA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

wsock32

WSAStartup
WSACleanup
closesocket
recv
send
select

wininet

InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetOpenA

Sections

.text
Size: 780KB - Virtual size: 777KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10.7MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e30ed92fbc97beb2965b6368568a6f4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comctl32

advapi32

shell32

ole32

gdiplus

atl

shlwapi

crypt32

msimg32

oledlg

rasapi32

winspool.drv

wsock32

wininet

Sections

.text Size: 780KB - Virtual size: 777KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 10.7MB - Virtual size: 10.9MB

.rsrc Size: 4KB - Virtual size: 744B

.text
Size: 780KB - Virtual size: 777KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 10.7MB - Virtual size: 10.9MB

.rsrc
Size: 4KB - Virtual size: 744B