blackmoon | 666648cf91aa5139ac2de5f14b1fcb4277dde20503f08037a1b64d5b6f26ed62

Sharing

Copy URL Twitter E-mail

General

Target

666648cf91aa5139ac2de5f14b1fcb4277dde20503f08037a1b64d5b6f26ed62
Size

1.9MB
MD5

f1f3991f0aa4717fa440406ee81f1f6d
SHA1

0c38438f521887a2e62e38872f12852e0b13189d
SHA256

666648cf91aa5139ac2de5f14b1fcb4277dde20503f08037a1b64d5b6f26ed62
SHA512

0d8fb59e573d4eeb33dc158e1d2d3986f4905156ef4c43421a7dd03897806b05672ffad5d626ac0b5785281c12d87ab33da67e90e37d8d084318e955c739f04b
SSDEEP

24576:gYiRjmIGHW9nmoHSPIZ6bZZr0fI1vmW06pF0kZECDx00Nltv/LQ57bJs8yqJLr:gYPQiECLtvDQBbCqJLr

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
666648cf91aa5139ac2de5f14b1fcb4277dde20503f08037a1b64d5b6f26ed62

Files

666648cf91aa5139ac2de5f14b1fcb4277dde20503f08037a1b64d5b6f26ed62
.exe windows x86

9eb0d8201f6626aba457c62961f19cc7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
ReadFile
GetFileSize
CreateFileA
GetEnvironmentVariableA
DeleteFileA
WriteFile
SetFileAttributesA
Sleep
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
IsBadReadPtr
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
MoveFileA
GetModuleFileNameA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
IsBadCodePtr
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
SetFilePointer
GetOEMCP
GetACP
GetCPInfo
RaiseException
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
GetVersion
GetStartupInfoA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
VirtualAlloc
LCMapStringW
VirtualFree
DeviceIoControl
GetVersionExA
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
DeleteFileA
GetModuleFileNameA
GetLocalTime
GetTickCount
GlobalAlloc
GlobalFree
GetUserDefaultLCID
HeapCreate
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
MulDiv
lstrcpyn
GlobalUnlock
GlobalLock
GetFileSize
GetTimeFormatA
IsBadWritePtr
WriteFile
CloseHandle
GetLastError
RtlFillMemory
GetModuleHandleA
ReadFile
SetLastError
CreateFileA
SetEndOfFile
RtlMoveMemory
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
GetCurrentProcess
TerminateProcess
Sleep
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
lstrcpyA
InterlockedExchange
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
GetDateFormatA
HeapSize
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
WritePrivateProfileStringA
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcpynA
FlushFileBuffers
LocalFree
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
GetVersion
FindResourceA
LoadResource
LockResource
lstrcatA
IsBadReadPtr

shlwapi

PathFileExistsA
UrlUnescapeA
PathFileExistsA

user32

GetWindowThreadProcessId
GetAsyncKeyState
mouse_event
IsWindow
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
wvsprintfA
PtInRect
GetWindow
GetParent
PostQuitMessage
TabbedTextOutA
SetWindowLongA
GetDlgItem
ShowWindow
UpdateWindow
SystemParametersInfoA
GetDC
ReleaseDC
keybd_event
GetClassNameA
IsWindow
SendMessageA
GetWindowRect
GetSystemMetrics
VkKeyScanExA
GetKeyboardLayout
MessageBoxA
FillRect
DrawTextA
InvertRect
wsprintfA
CloseClipboard
SetClipboardData
EmptyClipboard
IsWindowVisible
UnhookWindowsHookEx
DestroyWindow
CreateDialogIndirectParamA
PostMessageA
SetCursor
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
SetWindowsHookExA
ValidateRect
SetActiveWindow
CallNextHookEx
GetActiveWindow
OpenClipboard
GetWindowTextA
GrayStringA
EndDialog
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
ClientToScreen
DestroyMenu
PostThreadMessageA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
GetClientRect
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
IsIconic
GetWindowPlacement
SetFocus
GetCursorPos
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
SetWindowPos
IsDialogMessageA
SendDlgItemMessageA
GetMenuItemCount
SetWindowTextA
GetDlgCtrlID
UnregisterClassA
GetKeyState

ole32

CLSIDFromProgID
CoUninitialize
CoInitialize
CoCreateInstance
OleRun
GetHGlobalFromStream
CreateStreamOnHGlobal
CLSIDFromString
OleInitialize
CoInitialize
CoUninitialize
OleFlushClipboard
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleIsCurrentClipboard
CoRevokeClassObject
OleUninitialize

advapi32

CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey

gdi32

PolyBezierTo
GetStockObject
SaveDC
RestoreDC
RectVisible
SetTextColor
SetMapMode
Polygon
Pie
SetViewportExtEx
ScaleViewportExtEx
ExtTextOutA
Escape
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Arc
SetViewportOrgEx
Chord
SetPixel
GetPixel
LineTo
MoveToEx
Ellipse
GetDIBits
Rectangle
TextOutA
GetObjectA
GetDeviceCaps
PtVisible
CreateBitmap
DeleteObject
CreateDIBSection
SelectObject
CreateHatchBrush
DeleteDC
StretchBlt
SetBkColor
CreateFontA
OffsetViewportOrgEx
CreateSolidBrush

wininet

InternetTimeFromSystemTime
InternetTimeToSystemTime

gdiplus

GdipSaveImageToStream
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream
GdipCreateBitmapFromStream

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

oleaut32

SafeArrayGetUBound
SafeArrayAccessData
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SafeArrayGetLBound
SafeArrayDestroyDescriptor

msimg32

TransparentBlt

oledlg

ord8

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17

Sections

.text
Size: 820KB - Virtual size: 819KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.0MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9eb0d8201f6626aba457c62961f19cc7

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

ole32

advapi32

gdi32

wininet

gdiplus

crypt32

oleaut32

msimg32

oledlg

winspool.drv

comctl32

Sections

.text Size: 820KB - Virtual size: 819KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 1.0MB - Virtual size: 1.1MB

.rsrc Size: 4KB - Virtual size: 664B

.text
Size: 820KB - Virtual size: 819KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 1.0MB - Virtual size: 1.1MB

.rsrc
Size: 4KB - Virtual size: 664B