blackmoon | f8d421cb9697a055cc0b7d1a0b245b20789a52a7974449fbe989844d8b658bfc

Sharing

Copy URL

Twitter E-mail

General

Target

f8d421cb9697a055cc0b7d1a0b245b20789a52a7974449fbe989844d8b658bfc
Size

11.0MB
MD5

c98cfc228149d4022c063a3c053fe2ba
SHA1

29a260c07db56d6c5eaa8d5fa7e7918b77721cad
SHA256

f8d421cb9697a055cc0b7d1a0b245b20789a52a7974449fbe989844d8b658bfc
SHA512

cecf6182270678d680e7e3ac29ce959772db67b39d7d41a7b296a723b0c8ce41346bf24231dcd1574b36839c2a533f13bf30e58453647cbe85c0433e9b9e9e32
SSDEEP

196608:1JV/WygmiA9Rd33kyfu5/SiPviOd+vemrCRQVDGxwWOG:1v4mj9n33kyG3niOYRruQV6xDOG

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8d421cb9697a055cc0b7d1a0b245b20789a52a7974449fbe989844d8b658bfc

Files

f8d421cb9697a055cc0b7d1a0b245b20789a52a7974449fbe989844d8b658bfc
.exe windows x86

4f45a892a34d7fd0d054cd150c6f3ae0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

kernel32

LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
SetFilePointer
GetLocalTime
SetFileAttributesA
WritePrivateProfileStringA
ReadConsoleA
GetStdHandle
WriteFile
GetPrivateProfileStringA
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetTickCount
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
SetConsoleTitleA
WideCharToMultiByte
MultiByteToWideChar
MoveFileA
GetLastError
GetCurrentProcess
SetConsoleMode
GetDriveTypeA
TerminateProcess
GetTempPathA
GetWindowsDirectoryA
Sleep
lstrcpyA
GetSystemDirectoryA
lstrlenA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
QueryPerformanceFrequency
QueryPerformanceCounter
GetTimeZoneInformation
DeviceIoControl
GetConsoleMode
GetACP
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
MulDiv
LocalFree
FlushFileBuffers
lstrcpynA
GetFullPathNameA
LocalAlloc
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
CreateDirectoryA
CreateEventA
OpenEventA
ReadConsoleInputA
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery

user32

TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
ClientToScreen
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
SetCursor
PostMessageA
PostQuitMessage
SetForegroundWindow
SetActiveWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
EnableWindow
GetParent
GetWindow
PtInRect
IsWindowVisible
GetWindowLongA
GetWindowTextA
GetCursorPos
SetWindowLongA
GetDlgItem
ShowWindow
UpdateWindow
SystemParametersInfoA
GetDC
ReleaseDC
GetClassNameA
SendMessageA
GetWindowRect
GetSystemMetrics
IsWindow
OpenIcon
CallWindowProcA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
CharUpperBuffW

gdi32

GetObjectA
GetStockObject
DeleteObject
DeleteDC
SelectObject
GetDeviceCaps
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox

advapi32

RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueExA

ole32

OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID

wininet

InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetConnectA
FtpFindFirstFileA
FtpOpenFileA
InternetSetFilePointer
InternetGetConnectedState

iphlpapi

GetAdaptersInfo

oledlg

ord8

oleaut32

SysFreeString
SafeArrayDestroy
VariantClear
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SysAllocString
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayGetUBound
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

shell32

SHGetSpecialFolderPathA
SHChangeNotify

comctl32

ord17

Sections

.text
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 828KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.5zP
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.me"
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.}9+
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 756B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4f45a892a34d7fd0d054cd150c6f3ae0

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

ole32

wininet

iphlpapi

oledlg

oleaut32

winspool.drv

shell32

comctl32

Sections

.text Size: 280KB - Virtual size: 280KB

.rdata Size: 828KB - Virtual size: 828KB

.data Size: 184KB - Virtual size: 184KB

.5zP Size: 3.4MB - Virtual size: 3.4MB

.me" Size: 4KB - Virtual size: 4KB

.}9+ Size: 6.4MB - Virtual size: 6.4MB

.rsrc Size: 756B - Virtual size: 756B

.l1 Size: 20KB - Virtual size: 20KB

.text
Size: 280KB - Virtual size: 280KB

.rdata
Size: 828KB - Virtual size: 828KB

.data
Size: 184KB - Virtual size: 184KB

.5zP
Size: 3.4MB - Virtual size: 3.4MB

.me"
Size: 4KB - Virtual size: 4KB

.}9+
Size: 6.4MB - Virtual size: 6.4MB

.rsrc
Size: 756B - Virtual size: 756B

.l1
Size: 20KB - Virtual size: 20KB