Behavioral task
behavioral1
Sample
f378b090c7ecd978baf232510d779cdcf968f05267bde569548e78980271e57a.exe
Resource
win7-20230831-en
General
-
Target
f378b090c7ecd978baf232510d779cdcf968f05267bde569548e78980271e57a
-
Size
768KB
-
MD5
ba5a9802d21c6382a5588b5197c2f53b
-
SHA1
030f28667c66e95907618820887699d345be6786
-
SHA256
f378b090c7ecd978baf232510d779cdcf968f05267bde569548e78980271e57a
-
SHA512
edf18759fb0765461755f3a4f9c4f2a44562a50c36d761c7fce48c07e7e470b454416e2c975c838bfc128bbe11476ddaeac8f2ac7a0699bd03c424692dbb05c6
-
SSDEEP
12288:vtLLLW5Nkkk3aMyeSWf+sEW/4TRJrzHlU2ZLqKnMMY0D8XLuPUIrHaXs3oSfl3zU:vtny5Nkkk3aMyeSWf+sEW/4TRJrzHlUY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f378b090c7ecd978baf232510d779cdcf968f05267bde569548e78980271e57a
Files
-
f378b090c7ecd978baf232510d779cdcf968f05267bde569548e78980271e57a.exe windows x86
5599a786f736a9256673ed097ec2c3c8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
FreeLibrary
GetCommandLineA
GlobalFree
GetUserDefaultLCID
GetLocalTime
SetFilePointer
GetFileSize
ReadFile
WriteFile
GetStartupInfoA
CreateProcessA
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
LocalSize
HeapAlloc
GetProcessHeap
WideCharToMultiByte
CloseHandle
CreateThread
VirtualProtect
ReadProcessMemory
GetProcAddress
LoadLibraryA
lstrcmpiW
SetStdHandle
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetOEMCP
GetCPInfo
FlushFileBuffers
GetCurrentProcess
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
lstrcpyA
lstrcatA
WritePrivateProfileStringA
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
RtlZeroMemory
lstrcmpiA
HeapDestroy
HeapCreate
lstrcpyn
GetAtomNameW
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
MultiByteToWideChar
lstrcatW
GlobalFlags
MulDiv
lstrcpynA
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
LocalFree
LocalAlloc
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
GetTickCount
lstrlenW
lstrcmpA
lstrlenA
IsBadCodePtr
VirtualFree
HeapFree
VirtualAlloc
ws2_32
WSAStartup
user32
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
GetNextDlgTabItem
DispatchMessageW
GetWindowRect
SetWindowPos
EnableWindow
IsWindowEnabled
IsWindowVisible
GetSysColor
DestroyAcceleratorTable
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
GetClientRect
SetCursor
DestroyCursor
SendMessageW
GetWindowLongW
GetParent
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
FindWindowExW
IsWindow
GetAsyncKeyState
SetWindowLongW
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
SetActiveWindow
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
SetWindowLongA
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
DrawTextA
TabbedTextOutA
SetClassLongW
UnhookWindowsHookEx
TranslateMessage
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
PtInRect
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SendMessageA
PostMessageA
DefWindowProcW
ShowWindow
PostMessageW
CopyIcon
GetIconInfo
ScreenToClient
ValidateRect
UpdateWindow
MoveWindow
SetParent
SetWindowTextW
MessageBoxW
GetDC
ReleaseDC
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
DrawIconEx
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
LoadStringW
CharUpperW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
PostQuitMessage
CharLowerW
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
GetClassNameA
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
GetWindowTextA
GetWindowThreadProcessId
EnumWindows
IsChild
GetMessageW
SetFocus
GetFocus
InvalidateRect
MapWindowPoints
ole32
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
StringFromGUID2
GetHGlobalFromStream
CLSIDFromString
OleRun
CoCreateInstance
CLSIDFromProgID
wininet
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetOpenA
shell32
DragQueryFileW
DragFinish
Shell_NotifyIconW
CommandLineToArgvW
DragAcceptFiles
gdi32
GetDIBits
CreatePatternBrush
CreateSolidBrush
CreateEllipticRgn
CreateFontIndirectW
GetObjectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
GetStockObject
CreateRoundRectRgn
SetViewportOrgEx
DeleteDC
SelectObject
DeleteObject
GetObjectA
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetClipBox
gdiplus
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipReleaseDC
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipDrawCurve
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipRotateWorldTransform
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipDeleteRegion
GdipDeletePath
GdiplusStartup
GdipDeleteFont
GdipDeleteStringFormat
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipDrawCurve2
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipGraphicsClear
GdipFillPolygon
GdipFillEllipse
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipFillPie
GdipFillPath
GdipFillClosedCurve
GdipGetNearestColor
GdipDrawLine
GdipDrawArc
GdipDrawBezier
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPie
GdipDrawPolygon
GdipSetImageAttributesThreshold
GdipDrawPath
GdipFillClosedCurve2
GdipFillRegion
GdipSetImageAttributesWrapMode
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesColorMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipFlush
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipGetDC
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetSolidFillColor
GdipSetSolidFillColor
GdipCreateSolidFill
GdipGetBrushType
GdipCloneBrush
GdipGetStringFormatMeasurableCharacterRangeCount
GdipSetStringFormatMeasurableCharacterRanges
GdipGetStringFormatDigitSubstitution
GdipSetStringFormatDigitSubstitution
GdipGetStringFormatTabStops
GdipGetStringFormatTabStopCount
GdipSetStringFormatTabStops
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatTrimming
GdipSetStringFormatTrimming
GdipGetStringFormatLineAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipGetStringFormatFlags
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipStringFormatGetGenericDefault
GdipCreateStringFormat
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipGetSmoothingMode
GdipDrawString
GdipWarpPath
atl
ord42
comctl32
ord17
InitCommonControlsEx
shlwapi
wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntExW
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
oledlg
ord8
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayAllocDescriptor
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
Sections
.text Size: 504KB - Virtual size: 501KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 120KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ