Behavioral task
behavioral1
Sample
39d8105e9b2c5bda3854975ccc7925a072f479904c699d7159d39b96e7f932b8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
39d8105e9b2c5bda3854975ccc7925a072f479904c699d7159d39b96e7f932b8.exe
Resource
win10v2004-20230703-en
General
-
Target
39d8105e9b2c5bda3854975ccc7925a072f479904c699d7159d39b96e7f932b8
-
Size
396KB
-
MD5
4aa06e72498d7923c7e727f4f28b1c8a
-
SHA1
633bde87e49781f1c1e6ac03739a0d0e7e685b0e
-
SHA256
39d8105e9b2c5bda3854975ccc7925a072f479904c699d7159d39b96e7f932b8
-
SHA512
f6178253800a33f1442b37c24e77f18b6f8456dcf8c0c70f34909ea98ff46be3f43f71e12eb47f723e24295232f2131a94c51c9fb712b7e7befab6518f911cf2
-
SSDEEP
12288:uawW9r4qSx1eG0/ImNMKGic2xZRMoo/nxh1H9kEOIK0Cp3fdG:uawW9r4qSx1eG0/ImNMKGic2xZRMoo/p
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39d8105e9b2c5bda3854975ccc7925a072f479904c699d7159d39b96e7f932b8
Files
-
39d8105e9b2c5bda3854975ccc7925a072f479904c699d7159d39b96e7f932b8.exe windows x86
e28c65f2c9857248a2d78281b882a108
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
GlobalFree
GetStartupInfoA
CreateProcessA
WaitForSingleObject
GetModuleFileNameA
CloseHandle
GetTickCount
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
InterlockedExchange
IsBadCodePtr
SetStdHandle
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
HeapReAlloc
ExitProcess
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
RtlZeroMemory
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
GetAtomNameW
WideCharToMultiByte
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
LocalSize
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
HeapAlloc
GetProcessHeap
RtlUnwind
GetOEMCP
GetCPInfo
SetErrorMode
SetThreadContext
GetThreadContext
OpenThread
Thread32Next
Thread32First
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
WritePrivateProfileStringA
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcpynA
FlushFileBuffers
LocalFree
MulDiv
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
GetVersion
FindResourceA
LoadResource
LockResource
lstrcatA
SetLastError
lstrcpyA
Sleep
TerminateProcess
GetVersionExA
GetCurrentProcess
GetLastError
SetFilePointer
WriteFile
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateThread
LeaveCriticalSection
IsBadReadPtr
shlwapi
PathRemoveFileSpecW
PathFindFileNameW
user32
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetWindowRect
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
DefWindowProcW
ShowWindow
PostMessageW
CopyIcon
GetIconInfo
SetFocus
GetFocus
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetParent
SetWindowTextW
MessageBoxW
GetDC
ReleaseDC
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
GetNextDlgTabItem
IsChild
TranslateMDISysAccel
IsDialogMessageW
PostQuitMessage
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
DrawIconEx
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
SetWindowRgn
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
RegisterWindowMessageA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
GetDlgCtrlID
SetActiveWindow
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
PostMessageA
GetWindow
PtInRect
FindWindowExA
GetCursorPos
SystemParametersInfoA
FindWindowA
SetCursorPos
mouse_event
GetClassNameA
CreateDialogIndirectParamA
GetMessageA
SendMessageA
DispatchMessageA
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
BlockInput
PeekMessageA
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetWindowTextA
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
MessageBoxA
wsprintfA
GetWindowTextA
GetWindowTextLengthA
GetWindowLongA
SetWindowLongA
SetForegroundWindow
gdi32
SelectObject
DeleteDC
CreateRoundRectRgn
BitBlt
CreateCompatibleDC
GetStretchBltMode
SetStretchBltMode
StretchBlt
GetObjectW
GetStockObject
CreateFontIndirectW
CreateEllipticRgn
CreateSolidBrush
CreatePatternBrush
GetDIBits
GetObjectA
GetDeviceCaps
DeleteObject
CreateDIBSection
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
shell32
Shell_NotifyIconW
DragAcceptFiles
CommandLineToArgvW
DragFinish
DragQueryFileW
ShellExecuteA
comctl32
InitCommonControlsEx
ord17
ole32
StringFromGUID2
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CreateStreamOnHGlobal
CLSIDFromString
GetHGlobalFromStream
csisocket
ord6
ord8
ord23
ord20
gdiplus
GdipAddPathCurve2
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipFlush
GdipGetDC
GdipReleaseDC
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipSetInterpolationMode
GdipAddPathCurve
GdipAddPathBezier
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipGetInterpolationMode
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetWorldTransform
GdipGetWorldTransform
GdipDeleteMatrix
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipDrawLine
GdipDrawArc
GdipDrawBezier
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPie
GdipDrawPolygon
GdipDrawPath
GdipDrawCurve
GdipDrawCurve2
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipGraphicsClear
GdipFillPolygon
GdipFillEllipse
GdipFillPie
GdipFillPath
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillRegion
GdipDrawString
GdipMeasureString
GdipCreateRegion
GdipMeasureCharacterRanges
GdipDrawDriverString
GdipDrawImage
GdipDrawImageRectRect
GdipDrawImageRect
GdipDrawImagePoints
GdipDrawImagePointRect
GdipDrawImagePointsRect
GdipSetClipGraphics
GdipSetClipPath
GdipSetClipRect
GdipSetClipRegion
GdipSetClipHrgn
GdipResetClip
GdipTranslateClip
GdipGetClip
GdipGetClipBounds
GdipGetVisibleClipBounds
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisibleRect
GdipSaveGraphics
GdipRestoreGraphics
GdipDeleteGraphics
GdipBeginContainer2
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipFillRectangle
GdipCreateTexture
GdipAddPathArc
GdipAddPathLine
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetImageBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipCreateFont
GdipCreateFontFromLogfontW
GdipClosePathFigure
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneFont
GdipGetLogFontW
GdipGetLogFontA
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdiplusStartup
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdipDeleteBrush
GdipDisposeImage
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipBeginContainer
GdipDeletePrivateFontCollection
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathRectangle
atl
ord42
msimg32
AlphaBlend
oledlg
ord8
oleaut32
VariantTimeToSystemTime
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
Sections
.text Size: 324KB - Virtual size: 321KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ