blackmoon | d50817b498d2624fae8e5998bf447238766c7c09b82b67df028f8d7f1eb8bc91

Sharing

Copy URL Twitter E-mail

General

Target

d50817b498d2624fae8e5998bf447238766c7c09b82b67df028f8d7f1eb8bc91
Size

2.4MB
MD5

f630cc0090643ae62054b4331cea0f7b
SHA1

74551870c4ccb992e8ca0eb4e2033ef9a0c86c46
SHA256

d50817b498d2624fae8e5998bf447238766c7c09b82b67df028f8d7f1eb8bc91
SHA512

9755f0965f620a067b1e5f7241d8ab8aef5016411e62df547333d35f734e90b46818196a9a47ee178c2befa0738ddc028269656a45100f460f4336568edea02d
SSDEEP

49152:GLesnzPJp7sb5aMsIhI8G2w/kXU4hwLIVyVG2NPmBO:GefdHwME4L2H

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d50817b498d2624fae8e5998bf447238766c7c09b82b67df028f8d7f1eb8bc91

Files

d50817b498d2624fae8e5998bf447238766c7c09b82b67df028f8d7f1eb8bc91
.exe windows:6 windows x86

8f0d1e4ec2314834a66e057bff1f2594

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntW
PathFileExistsA
PathFindExtensionA
PathFindFileNameA
StrTrimW
StrToIntExW
PathIsDirectoryW

winmm

waveOutSetVolume

ws2_32

recv
WSACleanup
inet_ntoa
ntohs
htons
inet_addr
WSAAsyncSelect
getsockname
connect
socket
closesocket
WSAStartup
send
select
gethostbyname

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

GlobalHandle
EnterCriticalSection
GetCommandLineA
SetCurrentDirectoryA
MoveFileA
CopyFileA
SetFilePointer
SetFileAttributesA
LCMapStringA
GetUserDefaultLCID
FindClose
FindFirstFileA
FindNextFileA
GetTickCount
GetFileSize
ReadFile
GetStartupInfoA
WriteFile
CreateDirectoryA
WritePrivateProfileStringA
DeleteFileA
GetModuleFileNameA
LeaveCriticalSection
IsBadReadPtr
HeapReAlloc
ExitProcess
lstrcpynA
SetProcessWorkingSetSize
GetSystemTime
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
SuspendThread
TerminateThread
QueueUserAPC
lstrcmpW
HeapCreate
HeapDestroy
RtlZeroMemory
InterlockedDecrement
InterlockedIncrement
GetLastError
GetCurrentDirectoryW
FreeLibrary
CreateThread
GlobalFree
GetPrivateProfileStringA
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
GetTempPathW
lstrcpyA
VirtualQueryEx
TerminateProcess
GetEnvironmentVariableA
WaitForSingleObject
ResumeThread
SetThreadContext
VirtualProtectEx
VirtualAllocEx
ReadProcessMemory
GetThreadContext
CreateProcessA
LocalSize
GetWindowsDirectoryA
CopyFileExA
GetDiskFreeSpaceExA
GetCompressedFileSizeA
HeapFree
HeapAlloc
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
GetLocalTime
Sleep
VirtualFree
VirtualAlloc
GlobalMemoryStatusEx
LocalFree
LocalAlloc
GetProcessHeap
WideCharToMultiByte
lstrlenW
RtlMoveMemory
LoadLibraryA
lstrcpyn
MultiByteToWideChar
WriteProcessMemory
GetCurrentProcess
GetCurrentProcessId
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
GetProcAddress
GetModuleHandleA
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
TlsAlloc
FlushFileBuffers
MulDiv
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
DeleteCriticalSection
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
InitializeCriticalSection
VirtualProtect
GetCurrentDirectoryA
GetVersion
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
HeapSize
GetVersionExA
GetTempPathA
GetSystemDirectoryA
VerLanguageNameA
lstrlenA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
GetTimeZoneInformation
GetACP

user32

UpdateWindow
GetDlgItem
FindWindowExA
EnumWindows
PtInRect
GetWindow
GetParent
EnableWindow
IsWindowEnabled
GetForegroundWindow
GetActiveWindow
SetForegroundWindow
SetWindowTextA
PostQuitMessage
PostMessageA
SetCursor
GetLastActivePopup
SetWindowsHookExA
ValidateRect
CallNextHookEx
GetKeyState
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
DestroyWindow
CreateDialogIndirectParamA
EndDialog
FindWindowA
GetDlgCtrlID
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
PostThreadMessageA
UnregisterClassA
DestroyMenu
CloseClipboard
SetClipboardData
EmptyClipboard
IsWindow
OpenClipboard
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
DispatchMessageA
GetWindowLongA
IsWindowVisible
GetWindowTextA
SendMessageA
GetClassNameA
GetCursorPos
GetDC
GetDesktopWindow
GetWindowRect
ReleaseDC
GetMessageA
wsprintfA
MessageBoxA
RemovePropA
SetWindowLongA
SetLayeredWindowAttributes
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
SetTimer
KillTimer
SystemParametersInfoA
SetActiveWindow
ShowWindow
SetPropA
GetPropA
CallWindowProcA
GetSystemMetrics

gdi32

SetMapMode
GetClipBox
SetTextColor
ScaleWindowExtEx
SetBkColor
RestoreDC
SetWindowExtEx
SaveDC
CreateBitmap
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetObjectA
GetDIBits
DeleteDC
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetDeviceCaps

advapi32

CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
DragFinish
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteExW
DragQueryFileA
SHGetMalloc
ShellExecuteA

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoRevokeClassObject
CLSIDFromProgID
CoCreateInstance
OleRun
CoInitializeEx
CLSIDFromString
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize

wininet

InternetOpenUrlA
InternetGetConnectedState
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetSetCookieA
InternetGetCookieA

winhttp

WinHttpSetCredentials
WinHttpCloseHandle
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpOpen
WinHttpCrackUrl
WinHttpSendRequest
WinHttpCheckPlatform

psapi

GetModuleFileNameExA

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSaveImageToStream
GdipDisposeImage
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdipCreateBitmapFromStream

oleaut32

SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
VariantInit
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
RegisterTypeLi

rasapi32

RasGetConnectStatusA
RasHangUpA

oledlg

ord8

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

comctl32

ord17

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 798KB - Virtual size: 998KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f0d1e4ec2314834a66e057bff1f2594

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

winmm

ws2_32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

winhttp

psapi

gdiplus

oleaut32

rasapi32

oledlg

winspool.drv

comctl32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 798KB - Virtual size: 998KB

.rsrc Size: 512B - Virtual size: 464B

.reloc Size: 64KB - Virtual size: 64KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 798KB - Virtual size: 998KB

.rsrc
Size: 512B - Virtual size: 464B

.reloc
Size: 64KB - Virtual size: 64KB