blackmoon | 8e8e71971ad70490cf6eaa102e57cbbf2b094efc5f749a57635b4662bde2f021

Sharing

Copy URL Twitter E-mail

General

Target

8e8e71971ad70490cf6eaa102e57cbbf2b094efc5f749a57635b4662bde2f021
Size

12.3MB
MD5

32026d29c59e5e4ac78db20001357418
SHA1

bacb49700629dfdbc37de6711e43f1c3c618606f
SHA256

8e8e71971ad70490cf6eaa102e57cbbf2b094efc5f749a57635b4662bde2f021
SHA512

035e8717a5088a938563bacdcac7c7eaadabff60489a55f400b3d465e28f3163c6bd27eb9094b03df1b226d2da99942c69b4e148bbca15eb26643f596ac04230
SSDEEP

393216:NnzbcuxZxj6qplm44QTCMfJ5AM6idDKUt:5LZxjtlm7TMfl6id

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e8e71971ad70490cf6eaa102e57cbbf2b094efc5f749a57635b4662bde2f021

Files

8e8e71971ad70490cf6eaa102e57cbbf2b094efc5f749a57635b4662bde2f021
.exe windows:4 windows x86

effd0d655c0b6315ad3e566cf7c84cdc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
SizeofResource
FreeResource
RtlMoveMemory
GlobalSize
LocalSize
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
IsBadReadPtr
GetLocalTime
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
CreateFileA
GetTickCount
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
LoadResource
GetFileSize
GetUserDefaultLCID
FormatMessageA
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
FindResourceA
GetNativeSystemInfo
GetProcessHeap
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
MoveFileA
CreateDirectoryA
lstrlenW
CreateEventA
OpenEventA
CloseHandle
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
VirtualFree
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
ReadFile
GetModuleHandleW

user32

GetPropA
GetMessageW
SetActiveWindow
TranslateMessage
DispatchMessageW
RemovePropA
SetForegroundWindow
MessageBeep
DispatchMessageA
MoveWindow
PostMessageW
LoadCursorW
LookupIconIdFromDirectoryEx
RegisterClassExW
DefWindowProcW
SetCursor
SendMessageA
KillTimer
GetAsyncKeyState
InvalidateRect
UpdateLayeredWindow
ReleaseCapture
IsZoomed
GetWindowRect
LoadCursorFromFileW
SetTimer
PtInRect
ReleaseDC
SetCaretPos
GetCursorPos
CallWindowProcW
TrackMouseEvent
ShowWindow
BeginPaint
EndPaint
SetCapture
GetFocus
SetFocus
SetWindowLongW
SetWindowPos
SetPropA
GetClassLongW
GetWindowTextW
GetParent
SetWindowRgn
GetSystemMetrics
MessageBoxA
wsprintfA
SystemParametersInfoA
SendMessageW
CreateWindowExW
IsWindow
MsgWaitForMultipleObjects
CopyImage
CreateIconFromResourceEx
GetClassNameW
IsIconic
GetMessageA
PeekMessageA
IntersectRect

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyA

shell32

ShellExecuteA
SHGetSpecialFolderPathA
Shell_NotifyIconW

ole32

CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
StringFromGUID2
CLSIDFromString
CreateStreamOnHGlobal

gdiplus

GdipCreateMatrix
GdipSetWorldTransform
GdipDeleteMatrix
GdipCreateHBITMAPFromBitmap
GdipGetCompositingQuality
GdipCreatePathGradientFromPath
GdipFillPolygon
GdipCreatePen2
GdipSetSolidFillColor
GdipFillPath
GdipClosePathFigure
GdipAddPathArc
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipCreateRegionHrgn
GdipDeleteRegion
GdipGetRegionBounds
GdipMeasureCharacterRanges
GdipCreateLineBrush
GdipFillEllipseI
GdipCreateRegion
GdipSetStringFormatMeasurableCharacterRanges
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipLoadImageFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetStringFormatFlags
GdipGetStringFormatTrimming
GdipGetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDrawString
GdipCreateSolidFill
GdipGetFontHeight
GdipDeleteBrush
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipDeleteStringFormat
GdipSetStringFormatHotkeyPrefix
GdipCreateStringFormat
GdipDrawImageRect
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGraphicsClear
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipResetClip
GdipDeletePen
GdipDrawRectangle
GdipSetClipRect
GdipSetClipRegion
GdipCreateImageAttributes
GdiplusStartup
GdipDisposeImage
GdipDrawImageRectRect
GdipGetImageHeight
GdipGetImageWidth
GdipCloneBitmapArea
GdipGetImagePixelFormat
GdipMeasureString
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateFont
GdipGetFontStyle
GdipGetFontSize
GdipGetFamilyName
GdipDrawPolygon
GdipSetPenDashStyle

oleaut32

OleLoadPicture
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VarR8FromBool
VarR8FromCy
SafeArrayDestroy

ws2_32

WSAStartup

gdi32

CreateRectRgn
CreateRoundRectRgn
GetDeviceCaps
DeleteDC
GetDIBits
SelectObject
CreateDIBSection
CreateCompatibleDC
BitBlt
DeleteObject

imm32

ImmAssociateContext
ImmGetContext

msvcrt

floor
modf
sprintf
atoi
_CIpow
free
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
strrchr
_CIfmod
strncpy
strncmp
__CxxFrameHandler
strchr
strtod
realloc
memmove
calloc
_stricmp
_ftol

shlwapi

PathFileExistsA

Sections

.text
Size: 527KB - Virtual size: 527KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11.8MB - Virtual size: 11.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

effd0d655c0b6315ad3e566cf7c84cdc

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

gdiplus

oleaut32

ws2_32

gdi32

imm32

msvcrt

shlwapi

Sections

.text Size: 527KB - Virtual size: 527KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 11.8MB - Virtual size: 11.9MB

.rsrc Size: 16KB - Virtual size: 16KB

.text
Size: 527KB - Virtual size: 527KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 11.8MB - Virtual size: 11.9MB

.rsrc
Size: 16KB - Virtual size: 16KB