Behavioral task
behavioral1
Sample
1e55d6b675d4f62144582b526d6bb24b174c649dc1052416c93fa84ab4f7ecb0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1e55d6b675d4f62144582b526d6bb24b174c649dc1052416c93fa84ab4f7ecb0.exe
Resource
win10v2004-20230915-en
General
-
Target
1e55d6b675d4f62144582b526d6bb24b174c649dc1052416c93fa84ab4f7ecb0
-
Size
378KB
-
MD5
69e52945e2ec548f7311802de21401df
-
SHA1
ad773ae0197f0efb05544d3e76a860dc0157076b
-
SHA256
1e55d6b675d4f62144582b526d6bb24b174c649dc1052416c93fa84ab4f7ecb0
-
SHA512
40d13bc221943f66d25e6f67ed71c5981bfb9710724e2adc9b52572cbabd19f71237724bf0039e97ab03916cb9f7173d79dc5c0119a1d2784c035b30353d0821
-
SSDEEP
6144:GoW+zjorbVcJF8h8y+DQMs/AWV+5HLEdtIh4HJrmkQ9IaDLnsUxSo+zpc7A:GoW+zjofVcJF8h8BDQMs/AWV+5HLEdtT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e55d6b675d4f62144582b526d6bb24b174c649dc1052416c93fa84ab4f7ecb0
Files
-
1e55d6b675d4f62144582b526d6bb24b174c649dc1052416c93fa84ab4f7ecb0.exe windows:4 windows x86
6f8d3e352b5d0a04bf0f987f32c2b2bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpW
ResetEvent
CreateEventW
SetEvent
CreateThread
Sleep
WaitForSingleObject
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleHandleA
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
RtlZeroMemory
GetFileSize
CreateFileA
GetTickCount
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
DeleteCriticalSection
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
GetModuleFileNameW
WideCharToMultiByte
GetCommandLineW
GetModuleHandleW
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
LocalSize
HeapFree
InterlockedDecrement
InterlockedIncrement
RtlMoveMemory
HeapAlloc
GetProcessHeap
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
CreateEventA
OpenEventA
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
ReadFile
TlsAlloc
user32
RemovePropA
EnumPropsExW
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
RemovePropW
CharUpperW
CharLowerW
PostMessageW
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
PostQuitMessage
GetNextDlgTabItem
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetMessageW
SetFocus
GetFocus
SetRect
ReleaseDC
DrawIconEx
GetDC
CopyIcon
LoadIconW
LoadImageW
CreateIconFromResourceEx
KillTimer
InvalidateRect
GetWindowRect
EnableWindow
IsWindowEnabled
GetSysColor
DestroyAcceleratorTable
LoadCursorW
ReleaseCapture
GetPropA
GetPropW
SetPropA
SetPropW
SetTimer
SetWindowTextW
MessageBoxW
SetParent
MoveWindow
UpdateWindow
ValidateRect
LoadStringW
ScreenToClient
MsgWaitForMultipleObjects
IsWindowVisible
FindWindowExA
IsWindow
GetWindowThreadProcessId
ShowWindow
DefWindowProcW
CallWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
MessageBoxA
GetWindowTextLengthA
GetWindowTextA
GetClassNameA
SetWindowPos
IsIconic
OpenIcon
GetIconInfo
DestroyCursor
DestroyIcon
SetWindowRgn
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetCapture
SetWindowLongW
GetAsyncKeyState
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
SetCursor
GetClientRect
CreateWindowExW
gdi32
CreatePatternBrush
CreateSolidBrush
CreateEllipticRgn
CreateFontIndirectW
GetDIBits
StretchBlt
SetStretchBltMode
GetStretchBltMode
BitBlt
GetStockObject
CreateRoundRectRgn
CreateDIBSection
CreateCompatibleDC
GetObjectW
DeleteDC
SelectObject
DeleteObject
advapi32
CryptGetHashParam
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptAcquireContextA
comctl32
InitCommonControlsEx
shlwapi
wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntExW
shell32
CommandLineToArgvW
Shell_NotifyIconW
DragFinish
DragQueryFileW
DragAcceptFiles
ole32
CoUninitialize
CoInitialize
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
gdiplus
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetWorldTransform
GdipGetWorldTransform
GdipDeleteMatrix
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipDrawLine
GdipDrawArc
GdipDrawBezier
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPie
GdipDrawPolygon
GdipDrawPath
GdipDrawCurve
GdipDrawCurve2
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipGraphicsClear
GdipFillPolygon
GdipFillEllipse
GdipFillPie
GdipFillPath
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillRegion
GdipGetTextRenderingHint
GdipMeasureString
GdipCreateRegion
GdipMeasureCharacterRanges
GdipDrawDriverString
GdipDrawImage
GdipDrawImageRectRect
GdipDrawImageRect
GdipDrawImagePoints
GdipDrawImagePointRect
GdipDrawImagePointsRect
GdipSetClipGraphics
GdipSetClipPath
GdipSetClipRect
GdipSetClipRegion
GdipSetClipHrgn
GdipResetClip
GdipTranslateClip
GdipGetClip
GdipGetClipBounds
GdipGetVisibleClipBounds
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisibleRect
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipGetImageBounds
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipCreateHICONFromBitmap
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipCreateMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreateFromHWND
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDeletePrivateFontCollection
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneFont
GdipGetLogFontW
GdipGetLogFontA
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipCreatePath
GdipCreatePath2
GdipClonePath
GdipResetPath
GdipGetPathFillMode
GdipSetPathFillMode
GdipGetPointCount
GdipGetPathData
GdipStartPathFigure
GdipClosePathFigure
GdipClosePathFigures
GdipSetPathMarker
GdipClearPathMarkers
GdipReversePath
GdipGetPathLastPoint
GdipAddPathLine
GdipAddPathArc
GdipAddPathBezier
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathRectangle
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipFlattenPath
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipImageSelectActiveFrame
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipDrawString
GdipSetImageAttributesOutputChannel
atl
ord42
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
free
malloc
floor
_CIfmod
atoi
_ftol
strchr
atof
strtod
strrchr
realloc
modf
strncmp
__CxxFrameHandler
memmove
_stricmp
Sections
.text Size: 327KB - Virtual size: 326KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE