blackmoon | 650b3d24c97f696fb7a3e2ec4bb8c3b65b52a617e3d9b717c4891045577b6f88

Sharing

Copy URL

Twitter E-mail

General

Target

650b3d24c97f696fb7a3e2ec4bb8c3b65b52a617e3d9b717c4891045577b6f88
Size

1.0MB
MD5

2bf82d181a900e4d1e644098fab0b25e
SHA1

6f4f67934d59266c77874e07b593bca333b0da18
SHA256

650b3d24c97f696fb7a3e2ec4bb8c3b65b52a617e3d9b717c4891045577b6f88
SHA512

720f644aa21ea3bfa4ba64480285a27efd2a7891413eea954373a115cf292ef3929ff4bfe13595fbc2e68c975624a8753e83a6346443291283b71897dfa3d39b
SSDEEP

24576:tC+CoUHo/dOo6qKvLYtprCcv4ClI4xOoX2dgFOFo0:tPXF8l

Score

10^/10

oss_ak blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

detect oss ak 1 IoCs

oss ak information detected.

oss_ak

resource	yara_rule
sample	detect_ak_stuff

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
650b3d24c97f696fb7a3e2ec4bb8c3b65b52a617e3d9b717c4891045577b6f88

Files

650b3d24c97f696fb7a3e2ec4bb8c3b65b52a617e3d9b717c4891045577b6f88
.exe windows x86

ecd3844837d8b5262b1ed3236b080734

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
LoadLibraryA
FreeLibrary
GetCommandLineA
WritePrivateProfileStringA
GetTickCount
GetPrivateProfileStringA
GetFileSize
WriteFile
SetFilePointer
Sleep
FormatMessageA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
GetStartupInfoA
CreateProcessA
DeleteFileA
CreateDirectoryA
GetModuleFileNameA
GetProcAddress
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
lstrcpynA
DeleteTimerQueueEx
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLocalTime
GetSystemTimeAsFileTime
CreateTimerQueue
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrcmpA
ReleaseMutex
CreateMutexA
lstrcpyn
WaitForSingleObject
lstrcmpiW
lstrcmpW
lstrlenW
HeapCreate
HeapDestroy
InterlockedDecrement
InterlockedIncrement
RtlZeroMemory
VirtualFree
lstrcatA
WideCharToMultiByte
lstrlenA
VirtualAlloc
RtlMoveMemory
GetCurrentThreadId
LocalSize
GetModuleHandleW
MultiByteToWideChar
HeapFree
HeapAlloc
GetProcessHeap
ReadFile
CloseHandle
GetFileSizeEx
CreateFileA
CreateThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
LCMapStringW
IsBadWritePtr
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetTimeZoneInformation
GetACP
RaiseException
TerminateProcess
RtlUnwind
GetOEMCP
GetCPInfo
GetCurrentProcess
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
SetLastError
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetTimeFormatA
GetDateFormatA
GetLastError
lstrcpyA
GlobalFlags
MulDiv
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
SetEndOfFile
QueryPerformanceCounter
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryW
HeapValidate
HeapSize
GetVersionExA
GetTempPathW
GetTempPathA
GetSystemTime
GetSystemInfo
GetFullPathNameW
GetFullPathNameA
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FormatMessageW
FlushFileBuffers
DeleteFileW
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
AreFileApisANSI
InterlockedCompareExchange
GetCurrentThread
lstrcmpiA
GlobalDeleteAtom
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue

user32

MapVirtualKeyA
GetMessageW
CallWindowProcW
BeginPaint
GetClientRect
IntersectRect
EndPaint
GetFocus
SetFocus
SetCapture
LoadIconW
CreateWindowExW
SystemParametersInfoW
PostQuitMessage
PostMessageA
SendMessageA
SetCursor
EnableWindow
GetWindowLongA
IsWindowEnabled
GetLastActivePopup
GetParent
SetWindowsHookExA
GetCursorPos
IsWindowVisible
ValidateRect
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
GetClassNameA
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
GetWindowTextA
UnhookWindowsHookEx
GetMenuItemCount
UpdateLayeredWindow
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
SendDlgItemMessageA
CallNextHookEx
IsDialogMessageA
SetWindowLongA
DefWindowProcW
SetWindowPos
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
CallWindowProcA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
SetActiveWindow
GetSysColor
MapWindowPoints
UpdateWindow
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
CreateDialogIndirectParamA
EndDialog
ShowWindow
DispatchMessageW
TranslateMessage
SetWindowsHookExW
PeekMessageA
GetMessageA
DispatchMessageA
MessageBeep
wsprintfA
MessageBoxA
wvsprintfA
RemovePropA
InvalidateRect
ReleaseDC
GetDC
OffsetRect
GetWindowRect
RegisterClassExW
LoadCursorW
DefWindowProcA
GetPropA
ReleaseCapture
ScreenToClient
IsRectEmpty
IsZoomed
PtInRect
IsWindow
GetWindowLongW
SetWindowLongW
SetPropA

gdi32

GetClipBox
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
ScaleWindowExtEx
DeleteDC
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
GetCurrentObject
BitBlt
PtVisible
GetDeviceCaps
GetStockObject
SetWindowExtEx
SetBkColor
RestoreDC
SaveDC
CreateBitmap
Escape
ExtTextOutA
TextOutA
RectVisible

advapi32

CryptDestroyHash
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
CryptAcquireContextA
CryptCreateHash
CryptHashData
RegCloseKey
CryptGetHashParam
CryptDeriveKey
CryptEncrypt
CryptDestroyKey
CryptDecrypt
CryptReleaseContext

ole32

OleIsCurrentClipboard
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleFlushClipboard
CoRevokeClassObject
OleInitialize
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleRun
CreateStreamOnHGlobal
CoUninitialize
CoInitialize

oleaut32

VariantTimeToSystemTime
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
SafeArrayDestroy
SystemTimeToVariantTime

ws2_32

WSACleanup
WSAStartup
setsockopt
WSAGetLastError
inet_addr
ntohs
WSASetLastError
htons
connect
select
__WSAFDIsSet
inet_ntoa
getpeername
getsockname
gethostbyname
closesocket
htonl
bind
send
recv
listen
accept
socket
sendto
recvfrom

gdiplus

GdipCreateFromHDC
GdipDeleteGraphics
GdipDisposeImage
GdipDrawImageRect
GdiplusStartup
GdipGetImageDimension
GdipLoadImageFromStream
GdiplusShutdown

iphlpapi

GetAdaptersInfo

shell32

ShellExecuteA

shlwapi

StrToIntW
StrToIntExW
PathFileExistsA

wininet

HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetSetOptionA
InternetQueryOptionA
InternetSetCookieA
HttpQueryInfoA
InternetCloseHandle

comdlg32

GetSaveFileNameA
GetOpenFileNameW

imm32

ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

oledlg

ord8

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

comctl32

ord17

Sections

.text
Size: 904KB - Virtual size: 901KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ecd3844837d8b5262b1ed3236b080734

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

gdiplus

iphlpapi

shell32

shlwapi

wininet

comdlg32

imm32

oledlg

winspool.drv

comctl32

Sections

.text Size: 904KB - Virtual size: 901KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 72KB - Virtual size: 154KB

.rsrc Size: 20KB - Virtual size: 18KB

.text
Size: 904KB - Virtual size: 901KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 72KB - Virtual size: 154KB

.rsrc
Size: 20KB - Virtual size: 18KB