blackmoon | 672c5d362286543cd8c22e4d13ba8699068b5879cadb7d64478eaf85285c5cf3

Sharing

Copy URL Twitter E-mail

General

Target

672c5d362286543cd8c22e4d13ba8699068b5879cadb7d64478eaf85285c5cf3
Size

3.1MB
MD5

b65af124c6708a980aef041466eb2494
SHA1

01049316572950026c8296ea0f52922ad6fbc676
SHA256

672c5d362286543cd8c22e4d13ba8699068b5879cadb7d64478eaf85285c5cf3
SHA512

2f59ad4b206d2b942870936a021c0bce8b58022c0ea4efce3866e2185f9cb1374a2529af4af8b3ce00ef70fb9697cda279cfa4185bdc8bec6c88dfbdd7c89901
SSDEEP

98304:S1J7g/WzWXVzTX0N4f5BhBChbF4LJ9lhp2VI:a0/0WlzoN4f5pCh+7T

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
672c5d362286543cd8c22e4d13ba8699068b5879cadb7d64478eaf85285c5cf3

Files

672c5d362286543cd8c22e4d13ba8699068b5879cadb7d64478eaf85285c5cf3
.exe windows x86

354f813f9662d8a36a6856caf247a130

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CloseHandle
WriteFile
CreateFileA
GetModuleFileNameA
GetModuleHandleA
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
GetCommandLineA
RtlMoveMemory
VirtualFree
VirtualAlloc
lstrcpynA
CreateFileW
HeapSize
MoveFileA
GetTickCount
CreateDirectoryA
GetStringTypeW
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
HeapSetInformation
GetStartupInfoW
RtlUnwind
SetUnhandledExceptionFilter
GetModuleHandleW
DecodePointer
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LoadLibraryW
Sleep
RaiseException
SetStdHandle
FlushFileBuffers
WriteConsoleW

user32

GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
PeekMessageA

shlwapi

PathFileExistsA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

354f813f9662d8a36a6856caf247a130

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

shell32

Sections

.text Size: 81KB - Virtual size: 81KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 3.0MB - Virtual size: 3.0MB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 3.0MB - Virtual size: 3.0MB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 14KB - Virtual size: 14KB