Behavioral task
behavioral1
Sample
7e6a036f1bcfbafc9f163671728f270e56d57f3cb9eb5fddd386b0ed3ffb9fc9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7e6a036f1bcfbafc9f163671728f270e56d57f3cb9eb5fddd386b0ed3ffb9fc9.exe
Resource
win10v2004-20230703-en
General
-
Target
7e6a036f1bcfbafc9f163671728f270e56d57f3cb9eb5fddd386b0ed3ffb9fc9
-
Size
13.1MB
-
MD5
209b7ca18ea3c45f2c60047963273e55
-
SHA1
450ff65dfa9388dfee1ac5c9cebce68c4224159a
-
SHA256
7e6a036f1bcfbafc9f163671728f270e56d57f3cb9eb5fddd386b0ed3ffb9fc9
-
SHA512
57f375f940e90f8f4e447a7ab697e9560c1e733b145082648a15a429a78dec0cbbcd9000cdf9558d82598d0ca9c46b44b42e531805d453a2b91822fad8a8ac9b
-
SSDEEP
196608:rIFNAyNUhLRK97KOdxQOL3vey1ip26BiUVP56dA/2xuo5fe4BYbci0mBj6iYa4Wl:rIrAVObxLSR3k2pT6iJsqhr4Y5d
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7e6a036f1bcfbafc9f163671728f270e56d57f3cb9eb5fddd386b0ed3ffb9fc9
Files
-
7e6a036f1bcfbafc9f163671728f270e56d57f3cb9eb5fddd386b0ed3ffb9fc9.exe windows x86
2f8a205a51501ae14e931cc70ad8fa22
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
RemoveDirectoryA
FindFirstFileA
SetFilePointer
GetUserDefaultLCID
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
FindNextFileA
FindClose
WriteFile
GetTickCount
WritePrivateProfileStringA
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetModuleFileNameA
GetPrivateProfileStringA
IsBadReadPtr
HeapReAlloc
ExitProcess
GlobalUnlock
GlobalLock
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
RaiseException
IsBadWritePtr
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetVersion
GetStartupInfoA
lstrcpyA
lstrcatA
MulDiv
DeleteCriticalSection
GetCurrentProcess
GetLastError
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
GlobalAlloc
lstrcmpW
RtlZeroMemory
lstrcmpiA
GlobalMemoryStatusEx
HeapDestroy
HeapCreate
GetAtomNameW
GetModuleFileNameW
WideCharToMultiByte
GetCommandLineW
GetModuleHandleW
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
GetProcessHeap
RtlMoveMemory
IsDebuggerPresent
GetModuleHandleA
MoveFileA
CreateDirectoryA
GetCurrentProcessId
CreateThread
GetLocalTime
GetProcAddress
Sleep
VirtualFree
VirtualAlloc
user32
GetWindowThreadProcessId
GetClientRect
IsWindow
CreateIconFromResourceEx
UpdateLayeredWindow
SystemParametersInfoW
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
SetRect
LoadIconW
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
BeginPaint
FindWindowA
SetLayeredWindowAttributes
SetWindowLongA
GetClassNameA
GetWindowTextA
IsWindowVisible
GetWindowLongA
LoadImageW
EndPaint
TrackMouseEvent
GetDlgItem
UnregisterHotKey
SendMessageA
RegisterHotKey
LoadBitmapA
GetCursorPos
CreateWindowExA
CallWindowProcA
DrawIconEx
GetAncestor
SetWindowLongW
GetAsyncKeyState
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
InvalidateRect
GetNextDlgTabItem
SetFocus
GetDC
DrawTextA
ReleaseDC
OffsetRect
DefWindowProcW
GetWindowDC
FillRect
ClientToScreen
GetFocus
GetMessageW
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
UpdateWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
ShowWindow
PostMessageW
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
GetDesktopWindow
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
CharLowerW
CharUpperW
LoadStringW
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuStringW
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
CopyIcon
GetIconInfo
GetSubMenu
SetMenuInfo
InsertMenuW
AppendMenuW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
ScreenToClient
ValidateRect
SetWindowRgn
advapi32
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
shell32
SHGetSpecialFolderPathA
DragQueryFileA
DragQueryFileW
DragFinish
Shell_NotifyIconW
CommandLineToArgvW
DragAcceptFiles
ole32
CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
comctl32
ImageList_DragLeave
ImageList_DragEnter
ImageList_Destroy
ImageList_Create
ImageList_BeginDrag
ImageList_Add
ImageList_DragShowNolock
ImageList_EndDrag
InitCommonControlsEx
ImageList_DragMove
ord17
gdi32
CreateEllipticRgn
CreatePatternBrush
GetDIBits
StretchBlt
CreateCompatibleBitmap
SetStretchBltMode
GetStretchBltMode
GetObjectA
GetObjectW
TranslateCharsetInfo
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
CreateSolidBrush
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
CreateFontIndirectW
CreateFontA
GetDeviceCaps
gdiplus
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipSetPathMarker
GdipClearPathMarkers
GdipCreateBitmapFromScan0
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipFlattenPath
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipCreateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipGetFontHeightGivenDPI
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipCreateSolidFill
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipBitmapLockBits
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipTransformMatrixPoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdiplusStartup
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipReversePath
GdipFillRegion
ws2_32
inet_ntoa
gethostbyname
WSACleanup
select
WSAAsyncSelect
ntohs
getsockname
send
connect
htons
inet_addr
socket
closesocket
WSAStartup
recv
atl
ord42
shlwapi
PathFileExistsA
StrToIntExW
wvnsprintfW
StrToIntW
StrTrimW
PathRemoveFileSpecW
PathFindFileNameW
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
oleaut32
SafeArrayGetDim
SafeArrayGetLBound
VariantInit
SafeArrayUnaccessData
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VarR8FromBool
VarR8FromCy
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayAccessData
Sections
.text Size: 668KB - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12.4MB - Virtual size: 12.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ