Behavioral task
behavioral1
Sample
517a9e4cfa89250926742906663055a6482ba1185e328a8640a240db3984a62f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
517a9e4cfa89250926742906663055a6482ba1185e328a8640a240db3984a62f.exe
Resource
win10v2004-20230915-en
General
-
Target
517a9e4cfa89250926742906663055a6482ba1185e328a8640a240db3984a62f
-
Size
6.7MB
-
MD5
cc10005b29adf3aa3f258383b7cb3cca
-
SHA1
646dd4c6152578c031c045b9b9dcd0ade45c4856
-
SHA256
517a9e4cfa89250926742906663055a6482ba1185e328a8640a240db3984a62f
-
SHA512
9223f8cd44814a3293604fb96ff56fd68f5d596a09217b084610dae911bdf5f21fe45d456563e9264adc06bc0977770c313c5235d7c24d6e23450c188783450a
-
SSDEEP
196608:dHoYb9sk7Ejwg8NJBSpTarrcNjAALfaHt9:dHoY5dKOL8NjDLfUt9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 517a9e4cfa89250926742906663055a6482ba1185e328a8640a240db3984a62f
Files
-
517a9e4cfa89250926742906663055a6482ba1185e328a8640a240db3984a62f.exe windows:4 windows x86
13697fb5dadcd8fa1c74caae9cd1f9f8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecW
PathFindFileNameW
StrToIntExA
kernel32
GetFileType
WriteFile
SetFilePointer
GetLastError
GetCurrentProcess
GetVersionExA
lstrcpyA
SetLastError
lstrcatA
LockResource
LoadResource
FindResourceA
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GlobalFree
CreateFileA
GetFileSize
ReadFile
WritePrivateProfileStringA
Sleep
IsBadReadPtr
HeapReAlloc
ExitProcess
InterlockedExchange
SetStdHandle
IsBadCodePtr
GetStringTypeW
GlobalUnlock
GlobalLock
GlobalAlloc
RtlZeroMemory
GetAtomNameW
GetModuleFileNameW
WideCharToMultiByte
GetCommandLineW
GetModuleHandleW
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
GetProcessHeap
TerminateThread
GetExitCodeThread
GetLocalTime
RtlMoveMemory
lstrcpyn
CreateThread
TerminateProcess
VirtualFree
VirtualAlloc
CloseHandle
OpenProcess
GetCurrentProcessId
GetModuleHandleA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcpynA
FlushFileBuffers
LocalFree
MulDiv
GlobalDeleteAtom
user32
GetMessageA
GetWindowInfo
EnumWindows
GetWindowThreadProcessId
GetWindowTextLengthA
GetWindowTextA
GetClassNameA
PostMessageA
GetParent
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
FindWindowExW
IsWindow
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
ReleaseDC
GetDC
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
SetWindowPos
GetFocus
SetFocus
GetMessageW
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
GetNextDlgTabItem
PostQuitMessage
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
DefWindowProcW
ShowWindow
PostMessageW
CopyIcon
GetIconInfo
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetParent
SetWindowTextW
MessageBoxW
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetWindowRgn
SetRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UnregisterHotKey
RegisterHotKey
SetWindowLongA
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
DrawIconEx
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
SetTimer
GetAsyncKeyState
CallWindowProcA
GetForegroundWindow
FindWindowExA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
PeekMessageA
DispatchMessageA
wsprintfA
CreateWindowExA
GetClassLongA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
SetWindowTextA
GetDlgCtrlID
SetActiveWindow
CreateDialogIndirectParamA
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
GetWindow
PtInRect
GetWindowLongA
GetCursorPos
SystemParametersInfoA
SendMessageA
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
MessageBoxA
GetWindowRect
gdi32
CreateFontIndirectA
GetDeviceCaps
CreateBitmap
SaveDC
RestoreDC
TextOutA
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SelectObject
SetBkMode
DeleteObject
DeleteDC
CreateRoundRectRgn
BitBlt
CreateCompatibleDC
CreateDIBSection
GetStretchBltMode
SetStretchBltMode
StretchBlt
GetObjectW
GetStockObject
CreateFontIndirectW
CreateSolidBrush
CreatePatternBrush
GetDIBits
GetObjectA
SetTextColor
SetBkColor
Escape
ExtTextOutA
RectVisible
PtVisible
advapi32
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
shell32
DragAcceptFiles
CommandLineToArgvW
Shell_NotifyIconW
DragFinish
DragQueryFileW
comctl32
ord17
InitCommonControlsEx
ole32
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
StringFromGUID2
GetHGlobalFromStream
CLSIDFromString
gdiplus
GdipSetSmoothingMode
GdipCreateFontFromDC
GdipGetSmoothingMode
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetWorldTransform
GdipGetWorldTransform
GdipDeleteMatrix
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipDrawLine
GdipDrawArc
GdipDrawBezier
GdipDrawRectangle
GdipDrawEllipse
GdipDrawPie
GdipDrawPolygon
GdipDrawPath
GdipDrawCurve
GdipDrawCurve2
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipGraphicsClear
GdipFillPolygon
GdipFillEllipse
GdipFillPie
GdipFillPath
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillRegion
GdipDrawString
GdipMeasureString
GdipCreateRegion
GdipMeasureCharacterRanges
GdipDrawDriverString
GdipDrawImage
GdipDrawImageRectRect
GdipDrawImageRect
GdipDrawImagePoints
GdipDrawImagePointRect
GdipDrawImagePointsRect
GdipSetClipGraphics
GdipSetClipPath
GdipSetClipRect
GdipSetClipRegion
GdipSetClipHrgn
GdipResetClip
GdipTranslateClip
GdipGetClip
GdipGetClipBounds
GdipGetVisibleClipBounds
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisibleRect
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainer2
GdipEndContainer
GdipLoadImageFromFile
GdipLoadImageFromStream
GdipCloneImage
GdipGetImageRawFormat
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageDimension
GdipCreateImageAttributes
GdipGetImageWidth
GdipGetImageHeight
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateTexture
GdipSetImageAttributesColorMatrix
GdipFillRectangle
GdipDeleteBrush
GdipGetInterpolationMode
GdipDeleteGraphics
GdipDisposeImage
GdiplusStartup
GdipDeleteFont
GdipDeletePath
GdipCloneImageAttributes
GdipSetImageAttributesToIdentity
GdipResetImageAttributes
GdipSetImageAttributesThreshold
GdipSetImageAttributesNoOp
GdipSetImageAttributesGamma
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageThumbnail
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateFromHWND
GdipGetImageGraphicsContext
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDeletePrivateFontCollection
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipDeleteFontFamily
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipDisposeImageAttributes
GdipGetDC
GdipSetImageAttributesColorKeys
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesRemapTable
GdipSetImageAttributesWrapMode
GdipGetImageBounds
GdipGetImageAttributesAdjustedPalette
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipDeleteRegion
GdipCreateBitmapFromGraphics
atl
ord42
msimg32
AlphaBlend
oledlg
ord8
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
Sections
.text Size: 468KB - Virtual size: 465KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6.2MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ