blackmoon | f68170dac2c42a8aeaed1c0ae921f859a9f4f6f111954921df7b789b7075b430

Sharing

Copy URL Twitter E-mail

General

Target

f68170dac2c42a8aeaed1c0ae921f859a9f4f6f111954921df7b789b7075b430
Size

6.2MB
MD5

0a640576a3da96b542119c929cf2eec1
SHA1

968faa1acb2a528074da3c2f134869ea18af21cd
SHA256

f68170dac2c42a8aeaed1c0ae921f859a9f4f6f111954921df7b789b7075b430
SHA512

e4bc33fc28456f53b4a83e077a500b2dc8322ecbf5a220c8f09821b08dc3d62c7410bb35af7670155a664ef59acbec97d665ef9ef82edb8b7b74c697270afa00
SSDEEP

98304:1D7f+5p0Zt0crgCslIpRlrymo2F0lJgo3u7vdYjJ8dcmZH:1Y+MlyRpyDQ0vv2d4KdN

Score

10^/10

vmprotect blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f68170dac2c42a8aeaed1c0ae921f859a9f4f6f111954921df7b789b7075b430

Files

f68170dac2c42a8aeaed1c0ae921f859a9f4f6f111954921df7b789b7075b430
.exe windows:5 windows x86

940c5a3b6eb17f671ff022b91ac1fcf8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
lstrlenA
LeaveCriticalSection
GetLastError
MultiByteToWideChar
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
TlsAlloc
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
InitializeCriticalSection
GlobalFlags
InterlockedDecrement
WritePrivateProfileStringA
lstrcatA
lstrcpyA
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
CreateThread
GetProcessVersion
SetErrorMode
FlushFileBuffers
GetCPInfo
GetOEMCP
RtlUnwind
TerminateProcess
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
EnterCriticalSection
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
GetTickCount
SetFileAttributesA
SetFilePointer
GetFileSize
ReadFile
GetLocalTime
WriteFile
GetModuleFileNameA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateFileA
DeviceIoControl
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
WideCharToMultiByte
lstrlenW
Sleep
CloseHandle
LocalFree
LocalAlloc
OpenProcess
lstrcpynA
GetCurrentProcess
GetVersionExA
GetVersion
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

SetFocus
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetMenuItemCount
UnhookWindowsHookEx
GetWindow
GetDlgCtrlID
PtInRect
GetClassNameA
GetMenuCheckMarkDimensions
LoadBitmapA
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
SetWindowsHookExA
GetLastActivePopup
SetCursor
PostMessageA
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
UnregisterClassA
GetClientRect
GetSystemMetrics
PeekMessageA
CreateDialogIndirectParamA
UpdateWindow
GetMessageA
SendMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
PostQuitMessage
SetWindowTextA
GetDlgItem
ShowWindow
SetWindowLongA
GetWindowRect
ScreenToClient
SetWindowPos
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
GetCursorPos
wsprintfA
MessageBoxA
GetWindowInfo
ClientToScreen
GetAsyncKeyState
FindWindowA
CharUpperBuffW
MessageBoxW

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
CreateServiceA
DeleteService
ControlService
StartServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW

ole32

CoInitialize

shlwapi

PathFileExistsA

gdi32

SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
PtVisible
SetBkColor
TextOutA
GetDeviceCaps
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
CreateBitmap
RectVisible
GetObjectA
GetStockObject
Escape
ExtTextOutA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

shell32

ShellExecuteA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ord17

wtsapi32

WTSSendMessageW

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 532KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.maopo
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 792B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

940c5a3b6eb17f671ff022b91ac1fcf8

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shlwapi

gdi32

wininet

shell32

winspool.drv

comctl32

wtsapi32

Sections

.text Size: 212KB - Virtual size: 212KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 532KB - Virtual size: 532KB

.vmp0 Size: 4KB - Virtual size: 4KB

.maopo Size: 1.0MB - Virtual size: 1.0MB

.vmp1 Size: 1.8MB - Virtual size: 1.8MB

.vmp2 Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 792B - Virtual size: 792B

.l1 Size: 16KB - Virtual size: 16KB

.text
Size: 212KB - Virtual size: 212KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 532KB - Virtual size: 532KB

.vmp0
Size: 4KB - Virtual size: 4KB

.maopo
Size: 1.0MB - Virtual size: 1.0MB

.vmp1
Size: 1.8MB - Virtual size: 1.8MB

.vmp2
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 792B - Virtual size: 792B

.l1
Size: 16KB - Virtual size: 16KB