blackmoon | 3ce2b52060d361d4b40174a7305b98f05c6307337798c3d2e0027e8a842667dd

Sharing

Copy URL Twitter E-mail

General

Target

3ce2b52060d361d4b40174a7305b98f05c6307337798c3d2e0027e8a842667dd
Size

6.8MB
MD5

2d8b1f6ed991d31e86ed665fc400ce79
SHA1

2b389f1a1e700cc6924131192fff1c9e28cbb259
SHA256

3ce2b52060d361d4b40174a7305b98f05c6307337798c3d2e0027e8a842667dd
SHA512

367f988bff30a75b3b596db0ff7b3693311a92d9b941e33cf99ab9907985cbaa53ec7837eb862048e14cbbce61e7aac363a168490e33e91c8e82b4249b16a154
SSDEEP

98304:c6ThhGf1kcHy5pKe+2DD2+QQu7gWnDgLfKYoU2es6Y540MLElRUOTUOm9:7hMf+Bme++fZucADiEUX++0w39

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ce2b52060d361d4b40174a7305b98f05c6307337798c3d2e0027e8a842667dd

Files

3ce2b52060d361d4b40174a7305b98f05c6307337798c3d2e0027e8a842667dd
.exe windows x86

234d3887d54d01f76141a6550fa34acc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
GetFileAttributesA
SetFilePointer
GetLastError
GetCurrentProcess
GetVersionExA
TerminateProcess
OpenProcess
GetWindowsDirectoryA
lstrcpyA
GetSystemDirectoryA
lstrlenA
GlobalAlloc
SetLastError
lstrcatA
GlobalUnlock
GetVersion
SetErrorMode
lstrcpynA
GetCurrentThreadId
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
LocalFree
FlushFileBuffers
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
GetExitCodeProcess
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
GlobalFree
CreateToolhelp32Snapshot
Process32First
Process32Next
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
LCMapStringA
LoadLibraryA
FreeLibrary
SetFileAttributesA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetFileSize
ReadFile
GetModuleFileNameA
GetTickCount
ReadConsoleA
GetStdHandle
WriteFile
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetCommandLineA
GetModuleHandleA
CreateFileA
MultiByteToWideChar
DeviceIoControl
GetTempPathA
IsDebuggerPresent
WideCharToMultiByte
GetProcAddress
CreateThread
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
MoveFileA
CreateDirectoryA
Sleep
GetLocalTime
GetCurrentProcessId
VirtualFree
VirtualAlloc
GlobalMemoryStatusEx
SetConsoleTitleA

shlwapi

PathFileExistsA

ws2_32

send
WSACleanup
gethostbyname
inet_ntoa
recv
WSAStartup
closesocket
socket
htons
inet_addr
getsockname
ntohs
WSAAsyncSelect
connect
select

user32

LoadStringA
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
DrawTextA
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadCursorA
GetSysColorBrush
DestroyMenu
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
PostMessageA
PostQuitMessage
SetForegroundWindow
GetForegroundWindow
IsWindowEnabled
EnableWindow
GetParent
GetWindow
PtInRect
GetWindowLongA
GetWindowTextA
SetWindowLongA
GetDlgItem
SystemParametersInfoA
GetClassNameA
SendMessageA
GetSystemMetrics
DestroyWindow
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
UnhookWindowsHookEx
LoadIconA
GrayStringA
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
FindWindowA
CreateWindowStationA
GetWindowThreadProcessId
ShowWindowAsync
MsgWaitForMultipleObjects
IsWindow
GetClientRect
MessageBoxA
wsprintfA
ReleaseDC
GetWindowRect
GetDesktopWindow
GetDC
DispatchMessageA
TranslateMessage
PeekMessageA
GetMessageA

gdi32

GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
DeleteObject
DeleteDC
GetDIBits
GetObjectA
StretchBlt
SetStretchBltMode
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape

advapi32

ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
CreateServiceA
OpenSCManagerA
DeleteService

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

shell32

SHGetSpecialFolderPathA

comctl32

ord17

Sections

.text
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6.5MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

234d3887d54d01f76141a6550fa34acc

Headers

File Characteristics

Imports

kernel32

shlwapi

ws2_32

user32

gdi32

advapi32

winspool.drv

shell32

comctl32

Sections

.text Size: 324KB - Virtual size: 323KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 6.5MB - Virtual size: 6.6MB

.rsrc Size: 4KB - Virtual size: 664B

.text
Size: 324KB - Virtual size: 323KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 6.5MB - Virtual size: 6.6MB

.rsrc
Size: 4KB - Virtual size: 664B