blackmoon | 9a4b4f52882b19b1dadab9a86250becfb2e3b88ad81a8569ff178aca7aee4e8e

Sharing

Copy URL Twitter E-mail

General

Target

9a4b4f52882b19b1dadab9a86250becfb2e3b88ad81a8569ff178aca7aee4e8e
Size

2.9MB
MD5

c1c8c70a0fd2680649a8a3021ea1bf6d
SHA1

cb681bf1bfa2ca25e24c3f5749e8559062350209
SHA256

9a4b4f52882b19b1dadab9a86250becfb2e3b88ad81a8569ff178aca7aee4e8e
SHA512

34d3d298f81d8efc7dbac27ebe82650a3fada95cdecf3b1aa84edde4276886e714d72d683e307606bb329a99381f473ab8b79bc7ab7e7fe4bc07c14414880073
SSDEEP

49152:3TolReaiqnpnn85rX/w0ziMkR637mn/h7:0neaRRn8WHW7mZ7

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a4b4f52882b19b1dadab9a86250becfb2e3b88ad81a8569ff178aca7aee4e8e

Files

9a4b4f52882b19b1dadab9a86250becfb2e3b88ad81a8569ff178aca7aee4e8e
.exe windows x86

d3973c1b07a8379328794b0a47890a8b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

PeekNamedPipe
GetFileSize
CreatePipe
GetComputerNameA
GetVersionExA
GetVolumeInformationA
DeviceIoControl
CreateFileA
Sleep
GetVersion
VirtualProtectEx
SetProcessWorkingSetSize
GetCurrentProcessId
VirtualQueryEx
ReadFile
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
GetProcessTimes
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetModuleFileNameA
Module32Next
LocalFree
LocalAlloc
TerminateThread
TerminateProcess
FileTimeToSystemTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsBadCodePtr
SetUnhandledExceptionFilter
GetExitCodeProcess
GetLastError
FormatMessageA
LoadLibraryExA
FreeLibrary
LCMapStringA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
GlobalFree
RtlFillMemory
CreateMutexA
ReleaseMutex
OpenMutexA
HeapFree
DebugActiveProcess
CreateEventA
GetShortPathNameA
WriteFile
SetFilePointer
CopyFileA
GetDateFormatA
GetTimeFormatA
DeleteFileA
MoveFileA
GetThreadContext
SetThreadContext
InterlockedIncrement
IsDBCSLeadByteEx
lstrlenA
GetCurrentThreadId
GetCommandLineA
GetStringTypeW
GetStringTypeA
IsBadWritePtr
LCMapStringW
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStdHandle
SetHandleCount
GetFileType
SetStdHandle
HeapSize
GetACP
GetSystemTime
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
FindResourceA
LoadResource
LockResource
WritePrivateProfileStringA
SetFileAttributesA
GetFileAttributesA
GetCurrentDirectoryA
SetLocalTime
GetStartupInfoA
GetUserDefaultLCID
CreateDirectoryA
FindFirstFileA
RemoveDirectoryA
GetTickCount
IsBadReadPtr
HeapReAlloc
ExitProcess
VirtualFree
FindNextFileA
VirtualAlloc
FindClose
LeaveCriticalSection
CreateProcessA
SetEndOfFile
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
GetLocalTime
GetThreadTimes
ResumeThread
SuspendThread
OpenThread
RtlMoveMemory
VirtualAllocEx
CreateThread
SetWaitableTimer
CreateWaitableTimerA
InterlockedDecrement
OpenEventA
Thread32Next
Thread32First
WaitForSingleObject
CreateRemoteThread
MulDiv
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
lstrcpynA
TlsAlloc
FlushFileBuffers
lstrcpyA
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
SetLastError
GetTimeZoneInformation
IsDebuggerPresent
GetProcessHeap
HeapAlloc
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
Module32First
OpenProcess
WriteProcessMemory
GetModuleHandleA
GetProcAddress
GetExitCodeThread
VirtualFreeEx
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
GetCurrentProcess
ReadProcessMemory
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
lstrcpyn
GetLongPathNameA
FreeLibrary
GetFullPathNameA
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GlobalReAlloc
FindNextFileA
lstrcpyA
WinExec
lstrlenA
lstrcatA
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
GlobalSize
ExitProcess
GetModuleFileNameA
ReadFile
LockResource
LoadResource
FindResourceA
SetEvent
CreateFileA
WaitForMultipleObjects
WriteFile
GetProfileStringA
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
ResumeThread
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
ExpandEnvironmentStringsA
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
GetFileAttributesA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
SetFilePointer
GetFileSize
GetCurrentProcess
TerminateProcess
SetLastError
GetTimeZoneInformation
GetVersion
CreateMutexA
ReleaseMutex
SuspendThread
InterlockedIncrement
InterlockedDecrement
LocalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcpynA
DuplicateHandle
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
lstrcmpiA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcmpA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
TlsSetValue
LocalReAlloc
TlsGetValue
GetFileTime
GetCurrentThread
GlobalFlags
CreateSemaphoreA
TerminateThread
InterlockedExchange
GetCurrentThreadId
SetErrorMode
GetProcessVersion
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
GetSystemTime
GetLocalTime
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
SetStdHandle

user32

PtInRect
GetMenuItemCount
TabbedTextOutA
DrawTextA
GrayStringA
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
GetMessagePos
GetMessageTime
GetClassLongA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
CreateDialogIndirectParamA
EndDialog
SetActiveWindow
SetWindowPos
SetParent
UpdateWindow
CallWindowProcA
SetLayeredWindowAttributes
GetWindowLongA
SetWindowTextA
GetWindowTextLengthA
GetClassNameA
GetParent
SwapMouseButton
SetClassLongA
LoadCursorFromFileA
CallNextHookEx
SetWindowsHookExA
UnregisterClassA
GetAsyncKeyState
ShowCursor
SetCapture
ReleaseCapture
ClipCursor
FindWindowExA
GetDoubleClickTime
mouse_event
SetCursorPos
ClientToScreen
SendInput
EnumChildWindows
GetWindow
GetDesktopWindow
SetTimer
ChangeDisplaySettingsA
EnumDisplaySettingsA
FindWindowA
MoveWindow
SetWindowLongA
MsgWaitForMultipleObjects
UnhookWindowsHookEx
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
keybd_event
SetPropA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
GetNextDlgTabItem
GetActiveWindow
ValidateRect
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
SetForegroundWindow
IsIconic
MapVirtualKeyA
GetCaretPos
EnumThreadWindows
SendMessageTimeoutA
CharLowerA
IsWindowVisible
ShowWindow
GetCursorPos
WindowFromPoint
SendMessageA
FlashWindowEx
ShowWindowAsync
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
GetSystemMetrics
wsprintfA
MessageBoxA
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
InvalidateRect
GetDlgCtrlID
EnumWindows
FlashWindow
GetWindowInfo
OpenIcon
GetDlgItem
GetDC
ReleaseDC
GetPropA
DestroyWindow
RemovePropA
CreateWindowExA
IsZoomed
UpdateLayeredWindow
DefWindowProcA
GetGUIThreadInfo
GetAncestor
ExitWindowsEx
PrintWindow
RegisterWindowMessageA
PeekMessageA
PostMessageA
GetWindowThreadProcessId
GetClientRect
GetForegroundWindow
AttachThreadInput
GetFocus
SetFocus
wvsprintfA
GetKeyState
IsWindow
GetWindowTextA
GetKeyboardState
EnableWindow
ActivateKeyboardLayout
GetKeyboardLayout
SystemParametersInfoA
GetKeyboardLayoutList
UnloadKeyboardLayout
CharUpperA
CreateWindowStationA
KillTimer
PostThreadMessageA
DispatchMessageA
TranslateMessage
GetWindowRect
GetMessageA
EnableMenuItem
GetActiveWindow
SetFocus
IsIconic
PeekMessageA
SetMenu
GetMenu
DeleteMenu
GetSystemMenu
DefWindowProcA
GetClassInfoA
IsZoomed
PostQuitMessage
CopyAcceleratorTableA
GetKeyState
TranslateAcceleratorA
IsWindowEnabled
ShowWindow
SystemParametersInfoA
LoadImageA
EnumDisplaySettingsA
GetWindow
InflateRect
EnableMenuItem
GetSubMenu
IntersectRect
GetDlgCtrlID
CreateAcceleratorTableA
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DestroyIcon
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
PtInRect
RegisterClipboardFormatA
SetRectEmpty
DispatchMessageA
GetMessageA
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ClientToScreen
ScreenToClient
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
wsprintfA
WindowFromPoint
DrawFocusRect
DrawEdge
DrawFrameControl
TranslateMessage
GetNextDlgTabItem
GetDesktopWindow
CloseClipboard
ChildWindowFromPointEx
GetDlgItem
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
LoadStringA
GetSysColorBrush
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
GetClipboardData
OpenClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
GetCursorPos
MessageBoxA
UnregisterClassA
SetWindowPos
SendMessageA
DestroyCursor
SetParent
IsWindow
PostMessageA
GetTopWindow
GetParent
GetFocus
GetClientRect
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
GetWindowRect
SetForegroundWindow
DestroyMenu
IsChild
ReleaseDC
IsRectEmpty
FillRect
GetDC
SetCursor
LoadCursorA
SetCursorPos
SetActiveWindow
GetSysColor
SetWindowLongA
GetClassNameA
GetWindowLongA
LoadIconA

gdi32

GetObjectA
Escape
ExtTextOutA
GetTextExtentPointA
CreateCompatibleBitmap
RectVisible
PtVisible
GetDeviceCaps
GetStockObject
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateRectRgn
DeleteDC
CreateDIBSection
CreateCompatibleDC
DeleteObject
TextOutA
SetTextColor
SetBkMode
SetMapMode
SelectObject
CreateFontIndirectA
CreateBitmap
SaveDC
GetPixel
RestoreDC
SetBkColor
CreateBitmap
CreateHatchBrush
CreateBrushIndirect
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetStretchBltMode
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
CreatePatternBrush
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SelectObject
GetObjectA
CreatePen
PatBlt
CombineRgn
Rectangle
FillRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
EndPath
Ellipse
CreateRectRgn
GetTextMetricsA
Escape
ExtTextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
SetDIBitsToDevice
StretchDIBits
SetTextColor
SetBkMode
TextOutA
SetBkColor
CreateRectRgnIndirect
CreateDIBSection
SetStretchBltMode
GetClipRgn
CreatePolygonRgn
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette

comdlg32

GetOpenFileNameA
ChooseColorA
GetFileTitleA
GetSaveFileNameA
GetFileTitleA

wininet

InternetReadFile
HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetSetCookieA
InternetTimeFromSystemTime
InternetTimeToSystemTime
InternetOpenA
FtpOpenFileA
HttpSendRequestA
FtpGetFileSize

shell32

SHChangeNotify
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetFileInfoA
Shell_NotifyIconA
ShellExecuteA

shlwapi

PathIsDirectoryEmptyA
PathRemoveBlanksA
PathMakeSystemFolderA
PathIsSystemFolderA
PathUnmakeSystemFolderA
PathFindFileNameA
StrTrimA
PathIsDirectoryA
PathRenameExtensionA
PathFileExistsA
PathFindExtensionA

oleaut32

SafeArrayCreate
LHashValOfNameSys
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
RegisterTypeLi
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi

dbghelp

MakeSureDirectoryPathExists

ole32

CoFreeUnusedLibraries
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize
CLSIDFromString
OleIsCurrentClipboard

gdiplus

GdipDeleteGraphics
GdipResetClip
GdipDeletePen
GdipDeletePath
GdipDrawRectangle
GdipCreatePen1
GdipSetSmoothingMode
GdipSetClipHrgn
GdipCreateFromHDC
GdiplusStartup
GdipDrawPath

advapi32

RegFlushKey
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
GetUserNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
LookupAccountSidA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winhttp

WinHttpTimeFromSystemTime
WinHttpTimeToSystemTime

oledlg

ord8

rasapi32

RasHangUpA
RasGetConnectStatusA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA
OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17
ImageList_Destroy
ord17
_TrackMouseEvent

wsock32

send
select
closesocket
WSAStartup
WSACleanup
recv

msvfw32

DrawDibDraw

avifil32

AVIStreamGetFrame
AVIStreamInfoA

winmm

waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutClose
waveOutGetNumDevs
waveOutOpen
midiOutUnprepareHeader
midiStreamOpen
midiStreamProperty
midiOutPrepareHeader
waveOutReset
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
waveOutRestart
PlaySoundA
midiStreamOut

ws2_32

inet_ntoa
ntohl
accept
getpeername
recv
ioctlsocket
recvfrom
WSACleanup
closesocket
WSAAsyncSelect

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 576KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3973c1b07a8379328794b0a47890a8b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

wininet

shell32

shlwapi

oleaut32

dbghelp

ole32

gdiplus

advapi32

psapi

version

winhttp

oledlg

rasapi32

winspool.drv

comctl32

wsock32

msvfw32

avifil32

winmm

ws2_32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 212KB - Virtual size: 208KB

.data Size: 576KB - Virtual size: 828KB

.rsrc Size: 32KB - Virtual size: 28KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 212KB - Virtual size: 208KB

.data
Size: 576KB - Virtual size: 828KB

.rsrc
Size: 32KB - Virtual size: 28KB