blackmoon | b85c5d3f41e0c9407be495b2bf98b2871c79cde363ad166a35e8e30609da65ba

Sharing

Copy URL

Twitter E-mail

General

Target

b85c5d3f41e0c9407be495b2bf98b2871c79cde363ad166a35e8e30609da65ba
Size

468KB
MD5

03129de1f14b1a0b765eb3f5691194c6
SHA1

baab7f040ad0a630fcbb42b02286fb8585367816
SHA256

b85c5d3f41e0c9407be495b2bf98b2871c79cde363ad166a35e8e30609da65ba
SHA512

b940deea0c5c29d407c01115c93d7270c76cac3a33f6ada998f5403fd1475e92e4df0782e6787fdc8893e2d70c8f3cb4d9bffa7a7e99cbb780350bba2731a09e
SSDEEP

6144:lA5kFnyf6FUy1WQNuFaTT1UGIEp6wNW3jFUj6wQ7vI7eFTlA2etgUot9oSi:eIyf6WgNYydkI6O6N2eFJSwoS

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b85c5d3f41e0c9407be495b2bf98b2871c79cde363ad166a35e8e30609da65ba

Files

b85c5d3f41e0c9407be495b2bf98b2871c79cde363ad166a35e8e30609da65ba
.dll windows x86

b7a38e9f25f3cb2de7fae4cae5cd7b1e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalReAlloc
TlsGetValue
InterlockedDecrement
SetErrorMode
lstrcatA
lstrcpyA
lstrcpynA
GetVersion
GlobalFlags
WritePrivateProfileStringA
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetFilePointer
FlushFileBuffers
ExitProcess
TlsSetValue
GetCPInfo
GetOEMCP
RtlUnwind
TerminateProcess
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
GlobalReAlloc
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalFree
LocalAlloc
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
VirtualProtect
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
lstrlenA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CloseHandle
WriteFile
SetFileAttributesA
Sleep
GetLocalTime
GetModuleFileNameA
GetCommandLineA
FreeLibrary
LCMapStringA
GetModuleHandleA
GetProcessHeap
GetProcAddress
LoadLibraryA
GetLastError
CreateFileA
DeviceIoControl

user32

SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
SetWindowLongA
GetWindowThreadProcessId
FindWindowExA
ReleaseDC
GetDC
GetMenuItemCount
GetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
SetWindowTextA
MessageBoxA
wsprintfA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
ValidateRect

advapi32

RegOpenKeyExA
OpenServiceA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
DeleteService
CreateServiceA
StartServiceA
ControlService
CloseServiceHandle
OpenSCManagerA

gdi32

CreateBitmap
DeleteDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SaveDC
RestoreDC
SelectObject
SetBkColor
SetTextColor
SetMapMode
GetObjectA
GetStockObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetDeviceCaps
DeleteObject

shell32

SHGetSpecialFolderPathA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ord17

Exports

Exports

hello

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 324KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7a38e9f25f3cb2de7fae4cae5cd7b1e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

gdi32

shell32

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 101KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 324KB - Virtual size: 420KB

.rsrc Size: 4KB - Virtual size: 708B

.reloc Size: 16KB - Virtual size: 13KB

.text
Size: 104KB - Virtual size: 101KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 324KB - Virtual size: 420KB

.rsrc
Size: 4KB - Virtual size: 708B

.reloc
Size: 16KB - Virtual size: 13KB