blackmoon | e938f57b3bc73e069ce2134cce652f2aedb1d026865e4f806da29637ceb01f30

Sharing

Copy URL Twitter E-mail

General

Target

e938f57b3bc73e069ce2134cce652f2aedb1d026865e4f806da29637ceb01f30
Size

787KB
MD5

9f744eca7e4bbcaa5abf085cc556f6ea
SHA1

4a328099a80e36b4d3687a3b6f0ff3789c2ea934
SHA256

e938f57b3bc73e069ce2134cce652f2aedb1d026865e4f806da29637ceb01f30
SHA512

0147812bc634e215541ea27869333e863ca5e254dd3d21bb62cfb4517e1b722cc3b803aea09bf6ba944346fbc26ad3392309b33d77d96cfb9622f8972ece9654
SSDEEP

24576:MNN+3/LuqtorBfRYAVOULvwG9io5UWLtIg0FzL1/kq0qLFjJ32rZJ/:+4hxcbqxJ3Q/

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e938f57b3bc73e069ce2134cce652f2aedb1d026865e4f806da29637ceb01f30

Files

e938f57b3bc73e069ce2134cce652f2aedb1d026865e4f806da29637ceb01f30
.exe windows x86

4aa622f79c11fb1fbdee27afe3ae5ae8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResetEvent
CreateEventW
SetEvent
CreateThread
CloseHandle
Sleep
WaitForSingleObject
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleHandleA
ExitProcess
HeapReAlloc
lstrcmpW
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
WriteFile
GetCommandLineA
LoadLibraryA
LCMapStringA
GetTickCount
RtlZeroMemory
lstrcmpiA
HeapDestroy
GetCurrentProcess
HeapCreate
GetAtomNameW
GetModuleFileNameW
WideCharToMultiByte
GetCommandLineW
GetModuleHandleW
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
LocalSize
HeapAlloc
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryExA
CreateMutexA
OpenMutexA
IsBadReadPtr

user32

GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
UpdateLayeredWindow
LoadStringW
CharUpperW
CharLowerW
MessageBoxA
CreatePopupMenu
LoadIconW
DispatchMessageA
GetMessageA
PeekMessageA
CreateMenu
DrawIconEx
LoadImageW
CreateIconFromResourceEx
SetRect
SystemParametersInfoW
RegisterWindowMessageW
DrawMenuBar
CopyIcon
PostMessageW
ShowWindow
DefWindowProcW
CallWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
PostQuitMessage
GetNextDlgTabItem
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
wsprintfA
TranslateMDISysAccel
IsChild
SystemParametersInfoA
EnumPropsExW
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
ReleaseDC
GetDC
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
UpdateWindow
ValidateRect
GetCursorPos
SetTimer
KillTimer
SetWindowRgn
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
GetMessageW
SetWindowPos
GetWindowRect
GetIconInfo
InvalidateRect
GetFocus
SetFocus
ScreenToClient

shlwapi

PathFileExistsA
StrToIntExW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
wvnsprintfW

gdi32

GetDIBits
CreateEllipticRgn
CreateFontIndirectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
BitBlt
GetStockObject
CreatePatternBrush
CreateSolidBrush
CreateDIBSection
CreateCompatibleDC
GetObjectW
CreateRoundRectRgn
DeleteDC
SelectObject
DeleteObject

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

shell32

DragAcceptFiles
CommandLineToArgvW
Shell_NotifyIconW
DragFinish
DragQueryFileW

comctl32

InitCommonControlsEx

ole32

CoUninitialize
CoInitialize
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString

gdiplus

GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipDrawLine
GdipDrawArc
GdipDrawBezier
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPie
GdipDrawPolygon
GdipDrawPath
GdipDrawCurve
GdipDrawCurve2
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipGraphicsClear
GdipFillPolygon
GdipFillEllipse
GdipFillPie
GdipFillPath
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillRegion
GdipDrawString
GdipMeasureString
GdipCreateRegion
GdipMeasureCharacterRanges
GdipDrawDriverString
GdipDrawImage
GdipDrawImageRectRect
GdipDrawImageRect
GdipDrawImagePoints
GdipDrawImagePointRect
GdipDrawImagePointsRect
GdipSetWorldTransform
GdipSetClipPath
GdipSetClipRect
GdipSetClipRegion
GdipSetClipHrgn
GdipResetClip
GdipTranslateClip
GdipGetClip
GdipGetClipBounds
GdipGetVisibleClipBounds
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisibleRect
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetImageBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipCreateHICONFromBitmap
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDeletePrivateFontCollection
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneFont
GdipGetLogFontW
GdipGetLogFontA
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipSetPathMarker
GdipClearPathMarkers
GdipReversePath
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathEllipse
GdipResetWorldTransform
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipFlattenPath
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipCreateSolidFill
GdipCreateMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdiplusStartup
GdipImageSelectActiveFrame
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipDeleteMatrix
GdipAddPathPie
GdipGetWorldTransform
GdipSetClipGraphics
GdipGetTextRenderingHint

atl

ord42

crypt32

CryptStringToBinaryW

msimg32

AlphaBlend

msvcrt

sprintf
_CIfmod
atoi
_ftol
_stricmp
strchr
atof
strtod
strrchr
free
malloc
strstr
calloc

oleaut32

VariantTimeToSystemTime

Sections

.text
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 399KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4aa622f79c11fb1fbdee27afe3ae5ae8

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

gdi32

advapi32

shell32

comctl32

ole32

gdiplus

atl

crypt32

msimg32

msvcrt

oleaut32

Sections

.text Size: 362KB - Virtual size: 362KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 399KB - Virtual size: 412KB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 362KB - Virtual size: 362KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 399KB - Virtual size: 412KB

.rsrc
Size: 7KB - Virtual size: 6KB