blackmoon | 9a2140369dadd36c8c333844a989d3743a1387ddb8295cdec9229b168b2d34f2

Sharing

Copy URL Twitter E-mail

General

Target

9a2140369dadd36c8c333844a989d3743a1387ddb8295cdec9229b168b2d34f2
Size

452KB
MD5

4d8bed08af0fbfebd0abd144d353aa28
SHA1

22e1336ffc08e25d704cdd4e15d99b2073521792
SHA256

9a2140369dadd36c8c333844a989d3743a1387ddb8295cdec9229b168b2d34f2
SHA512

d3aa3c3f43fc1ab34c481ed4cd132c810f4a9a411ebc1b6c168879d983b134e93fc2ddf21074bbcde23d6226265f7d9c8d790bfbc7119a5e3f43e36607372e95
SSDEEP

12288:U3vKFem1kA7bn6+QXvIDzJnnWXHEaZMAD4Mfo/7CmrSCCNND2MCs2cz8BBSydX13:U3vKFemNvn6+QfMzJnnWXHEaZMAD4Mf0

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a2140369dadd36c8c333844a989d3743a1387ddb8295cdec9229b168b2d34f2

Files

9a2140369dadd36c8c333844a989d3743a1387ddb8295cdec9229b168b2d34f2
.dll windows:4 windows x86

bc17c3d752cbc35796ee4b50447f10e1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
GetProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
FreeLibrary
GetCommandLineA
Sleep
GetVersionExA
LCMapStringA
GetModuleFileNameA
GetTickCount
QueryDosDeviceA
GetLocalTime
GlobalAlloc
GlobalLock
GlobalUnlock
HeapReAlloc
ExitProcess
GetProcessTimes
CreateRemoteThread
HeapAlloc
HeapFree
GetProcessHeap
VirtualProtectEx
WriteProcessMemory
VirtualFreeEx
CreateFileMappingA
VirtualAllocEx
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetOEMCP
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
IsBadReadPtr
RtlZeroMemory
IsBadWritePtr
LocalSize
VirtualQueryEx
VirtualQuery
SetErrorMode
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
GetWindowsDirectoryA
lstrlenW
GetTimeFormatW
GetDateFormatW
GetLastError
GetLogicalDriveStringsA
GetCurrentProcess
MultiByteToWideChar
GetTimeFormatA
GetCPInfo
GetDateFormatA
lstrcpyn
GetModuleHandleA
CreateThread
VirtualProtect
FlushFileBuffers
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
CloseHandle
LocalAlloc
LocalFree
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
InterlockedDecrement
lstrcatA
lstrcpyA
lstrcpynA
lstrlenA
GetVersion
GlobalFlags
WritePrivateProfileStringA
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
WriteFile
SetFilePointer
RtlMoveMemory

shlwapi

PathFindFileNameA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

user32

MessageBoxTimeoutA
GetWindowRect
GetMessageA
PeekMessageA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
AppendMenuA
DestroyMenu
LoadMenuA
GetSystemMenu
CreatePopupMenu
CreateMenu
ExitWindowsEx
SendMessageTimeoutA
ReleaseDC
GetDC
RegisterClassExA
SetActiveWindow
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
UnhookWindowsHookEx
UnregisterClassA
PtInRect
GetDlgCtrlID
GetWindow
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
GetWindowPlacement
SystemParametersInfoA
GetForegroundWindow
GetMessagePos
GetMessageTime
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
FillRect
SetClassLongA
GetClassLongA
SetRect
SetWindowRgn
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
SetParent
PostMessageA
SetWindowPos
MoveWindow
UpdateWindow
ValidateRect
InvalidateRect
ScreenToClient
GetFocus
SetFocus
GetDlgItem
GetWindowLongA
CreateWindowExA
DestroyCursor
SetWindowLongA
PostQuitMessage
DestroyIcon
TrackMouseEvent
SetCursor
LoadCursorA
DefMDIChildProcA
SendMessageA
DefWindowProcA
DestroyWindow
GetClientRect
GetAsyncKeyState
EndPaint
BeginPaint
CallWindowProcA
GetClassNameA
IsWindow
DispatchMessageA
TranslateMessage
IsDialogMessageA
TranslateAcceleratorA
GetParent

gdi32

SetViewportOrgEx
SetBkColor
SetBkMode
SetTextColor
CreatePatternBrush
CreateSolidBrush
StretchBlt
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
BitBlt
SelectObject
DeleteDC
CreateDIBSection
CreateCompatibleDC
GetObjectA
DeleteObject
GetStockObject
CreateBitmap
SaveDC
RestoreDC
SetMapMode
ScaleWindowExtEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps

advapi32

RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegOpenKeyA
RegCloseKey

shell32

DragAcceptFiles
Shell_NotifyIconA
DragFinish
DragQueryFileA

comctl32

InitCommonControlsEx
ord17

ole32

CLSIDFromString

oleaut32

VariantTimeToSystemTime

atl

ord42
ord47

gdiplus

GdiplusStartup

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

Exports

Exports

_ODBG_Pluginaction
_ODBG_Plugindata
_ODBG_Plugininit
_ODBG_Pluginmenu
_ODBG_Pluginsaveudd
_ODBG_Pluginuddrecord

Sections

.text
Size: 364KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc17c3d752cbc35796ee4b50447f10e1

Headers

File Characteristics

Imports

kernel32

shlwapi

version

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

atl

gdiplus

winspool.drv

Exports

Exports

Sections

.text Size: 364KB - Virtual size: 361KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 36KB - Virtual size: 109KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 364KB - Virtual size: 361KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 36KB - Virtual size: 109KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB