Behavioral task
behavioral1
Sample
df5e52fea70fe75896a37a829f354003faefb79bdc5e6ff36cb6a98705609129.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
df5e52fea70fe75896a37a829f354003faefb79bdc5e6ff36cb6a98705609129.exe
Resource
win10v2004-20230703-en
General
-
Target
df5e52fea70fe75896a37a829f354003faefb79bdc5e6ff36cb6a98705609129
-
Size
3.4MB
-
MD5
bba0a5b0a6e6f3765bac8cc8fd3614ba
-
SHA1
cac4395e0115c3492d629bec7f5cc45bae4cba49
-
SHA256
df5e52fea70fe75896a37a829f354003faefb79bdc5e6ff36cb6a98705609129
-
SHA512
6ccae0d659a7dfcbd774c26e4b5de6715f3b4f4a71ed4193cd65f3d20180b190b7e4361b0e16739e3020c3c30465dac9c7057bd3b4e72c568f12dce23adc253d
-
SSDEEP
49152:OD9Fa5rQCzCE1lozWCsVb6KUpZ+hDg1F2d6FSChCQBVBo+SHLBST1WA:rTzflI5SbWf+YFC0rN+OWA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df5e52fea70fe75896a37a829f354003faefb79bdc5e6ff36cb6a98705609129
Files
-
df5e52fea70fe75896a37a829f354003faefb79bdc5e6ff36cb6a98705609129.exe windows x86
895da8ef70900d7bea06dd9e9b78594f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
SetFilePointer
GlobalFlags
WritePrivateProfileStringA
GetCurrentProcess
GetVersionExA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
InterlockedExchange
lstrcpyA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateThread
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
FlushFileBuffers
lstrcpynA
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
SetLocalTime
LCMapStringA
GetEnvironmentVariableA
GetFileSize
ReadFile
GlobalFree
GetUserDefaultLCID
GetLocalTime
Sleep
GetTickCount
GetStartupInfoA
CreateProcessA
DeleteFileA
GetModuleFileNameA
CreateFileA
WriteFile
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
GlobalLock
GlobalAlloc
GetSystemInfo
CreateEventA
lstrcmpW
lstrcmpiA
MulDiv
GetAtomNameW
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
QueryDosDeviceA
GetLogicalDriveStringsA
TerminateProcess
MultiByteToWideChar
GlobalSize
lstrcpyn
GlobalUnlock
WideCharToMultiByte
GetSystemDirectoryA
GetTempPathA
HeapCreate
HeapDestroy
RtlZeroMemory
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
LocalSize
HeapAlloc
GetProcessHeap
CreateThread
CloseHandle
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerA
ReleaseMutex
CreateMutexA
FindClose
FindFirstFileW
LocalFree
CreateDirectoryW
LocalAlloc
RtlUnwind
TlsGetValue
shlwapi
PathFileExistsA
StrToIntExW
wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
PathIsDirectoryA
PathRemoveBlanksA
PathIsDirectoryW
ws2_32
WSACleanup
user32
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
RegisterWindowMessageA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
SetWindowTextA
GetDlgCtrlID
CreateDialogIndirectParamA
UnhookWindowsHookEx
GrayStringA
TabbedTextOutA
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
GetActiveWindow
GetKeyState
CallNextHookEx
SetWindowsHookExA
PostMessageA
GetWindow
PtInRect
GetWindowLongA
GetWindowTextA
SetWindowLongA
SystemParametersInfoA
GetClassNameA
SendMessageA
AdjustWindowRectEx
MapWindowPoints
LoadIconA
LoadCursorA
GetSystemMetrics
SetMenu
DrawMenuBar
RegisterWindowMessageW
GetDialogBaseUnits
MapDialogRect
GetDlgItemInt
GetSysColorBrush
LoadStringA
RemovePropA
RemovePropW
GetPropA
GetPropW
SetPropA
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
UpdateWindow
ValidateRect
ScreenToClient
GetIconInfo
CopyIcon
PostMessageW
CallWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
UnregisterClassA
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetMessageW
GetFocus
GetWindowInfo
MoveWindow
GetMenuStringA
GetMenuItemID
GetSubMenu
GetMenu
GetScrollInfo
SetDlgItemInt
GetDlgItemTextW
GetLastActivePopup
DrawIconEx
ChildWindowFromPointEx
IsZoomed
SwitchToThisWindow
SetDlgItemTextW
SendDlgItemMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
LoadStringW
CharUpperW
CharLowerW
MessageBoxA
wsprintfA
GetCursorPos
DispatchMessageA
GetMessageA
PeekMessageA
PostThreadMessageA
EnumPropsExW
LoadIconW
SetActiveWindow
WindowFromPoint
GetMenuBarInfo
RedrawWindow
EnableMenuItem
ShowWindow
IsIconic
EnumDisplaySettingsA
DrawIcon
GetCursorInfo
UnhookWinEvent
SetWinEventHook
SendInput
SetKeyboardState
AttachThreadInput
MapVirtualKeyA
MessageBoxTimeoutW
ClientToScreen
FillRect
GetWindowDC
DefWindowProcW
OffsetRect
DrawTextA
SetFocus
GetNextDlgTabItem
InvalidateRect
CheckRadioButton
FindWindowExA
GetWindowRect
SetWindowPos
EnableWindow
IsWindowEnabled
IsWindowVisible
GetSysColor
DestroyAcceleratorTable
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
GetClientRect
SetCursor
DestroyCursor
SendMessageW
GetWindowLongW
GetParent
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
FindWindowExW
IsWindow
GetAsyncKeyState
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
ReleaseDC
WindowFromDC
GetDC
SetClassLongW
SetRect
gdi32
PtVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
CreatePatternBrush
CreateEllipticRgn
CreateFontIndirectW
GetObjectW
SetStretchBltMode
GetStretchBltMode
CreateRoundRectRgn
Rectangle
StretchBlt
CreateBitmap
GetTextExtentPoint32A
CreateDIBitmap
BitBlt
CreateDIBSection
CreateCompatibleDC
CreateSolidBrush
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
GetCurrentObject
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
GetDeviceCaps
RectVisible
GetDIBits
advapi32
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptAcquireContextA
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptHashData
shell32
CommandLineToArgvW
SHAppBarMessage
Shell_NotifyIconW
DragFinish
DragAcceptFiles
DragQueryFileW
comctl32
InitCommonControlsEx
ord17
ole32
CLSIDFromProgID
CoCreateInstance
OleRun
CLSIDFromString
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
OleIsCurrentClipboard
gdiplus
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetLineSpacing
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipGetGenericFontFamilySansSerif
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipIsMatrixEqual
GdipCreateFontFromLogfontW
GdipCreateFont
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipGetRegionData
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipCreateBitmapFromFile
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipDeletePrivateFontCollection
GdipCreateBitmapFromHICON
GdipFillRectangle
GdipCreateTexture
GdipCloneFont
GdipGetGenericFontFamilySerif
GdipGetFontUnit
GdipRestoreGraphics
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdiplusShutdown
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdipSaveImageToStream
GdipDrawImageRectRect
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipCreateSolidFill
GdipCreateBitmapFromStream
GdiplusStartup
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
atl
ord42
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
iphlpapi
GetAdaptersInfo
oledlg
ord8
oleaut32
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
VariantInit
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayAllocDescriptor
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.0MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE