blackmoon | a603df069d3ef384d9243114822dbbf55ceaf19dba29310d5410afdce9f2ff4a

Sharing

Copy URL Twitter E-mail

General

Target

a603df069d3ef384d9243114822dbbf55ceaf19dba29310d5410afdce9f2ff4a
Size

876KB
MD5

ce4e5d3ecc91d3825d8229f6173639db
SHA1

c0b9121dd2c526f340cb5436c56e24e305df2ad2
SHA256

a603df069d3ef384d9243114822dbbf55ceaf19dba29310d5410afdce9f2ff4a
SHA512

74920d03a8bb7ef9ccae567677c5264bb400523f9f9c72597197b08f27a6aaa8502ccd0a422ba4e9ff00cbecbb8b29afed22267b6bf5e678881593d6a17ef438
SSDEEP

24576:sXhspfCJ7hnCYIL75L7/OdeVBXGhNijSEsWpGv3+QmvH0XdJCUf6t:sXGa1+QmwdPf

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a603df069d3ef384d9243114822dbbf55ceaf19dba29310d5410afdce9f2ff4a

Files

a603df069d3ef384d9243114822dbbf55ceaf19dba29310d5410afdce9f2ff4a
.dll windows:4 windows x86

bfd1643675eaa70336cb1e28770df16d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
CreateEventA
CloseHandle
WaitForMultipleObjects
OutputDebugStringA
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetEvent
InterlockedExchange
Sleep
InterlockedCompareExchange
ReadFile
CreateProcessA
GetStartupInfoA
CreatePipe
DeviceIoControl
CreateFileA
GetComputerNameA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
GetLastError
ResetEvent
GetVersion
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
RaiseException
DeleteFileA
GetCurrentProcess
GetSystemTimeAsFileTime
TlsAlloc
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
lstrcpyA
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
SetFilePointer
LCMapStringW
HeapSize
UnhandledExceptionFilter
FlushFileBuffers
SetUnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetStdHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
IsBadCodePtr
SetEndOfFile
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
RtlFillMemory
WideCharToMultiByte
GetTickCount
GetModuleHandleA
GetProcAddress
RtlMoveMemory
GetProcessHeap
HeapAlloc
LocalSize
InterlockedIncrement
lstrcatA
MulDiv
TerminateProcess
InterlockedDecrement
HeapFree
lstrlenA
lstrlenW
lstrcmpA
lstrcmpiW
lstrcatW
MultiByteToWideChar
GetModuleHandleW
LCMapStringA
LoadLibraryA
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GetUserDefaultLCID
IsBadReadPtr
HeapReAlloc
GetAtomNameW
ExitProcess
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
RtlZeroMemory
lstrcmpiA
HeapDestroy
HeapCreate
FreeEnvironmentStringsW
GetCommandLineW
GetModuleFileNameW
CreateThread

user32

GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
MessageBoxTimeoutA
GetMenuItemCount
GetMenuItemID
MsgWaitForMultipleObjects
GetWindowTextLengthA
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
DestroyMenu
GetMenuInfo
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
DrawIconEx
LoadImageW
CreateIconFromResourceEx
UpdateLayeredWindow
SystemParametersInfoW
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
IsZoomed
IsIconic
SetRect
LoadIconW
EnumPropsExW
RemovePropA
RemovePropW
CheckMenuRadioItem
UnregisterHotKey
SetWindowLongA
SendMessageA
RegisterHotKey
LoadBitmapA
GetCursorPos
CreateWindowExA
CallWindowProcA
GetPropA
GetPropW
SetPropA
SetPropW
KillTimer
SetTimer
MessageBoxW
SetWindowTextW
SetParent
MoveWindow
UpdateWindow
SetMenuDefaultItem
ScreenToClient
GetIconInfo
CopyIcon
PostMessageW
ShowWindow
CallWindowProcW
SetForegroundWindow
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetMessageW
GetFocus
InvalidateRect
ClientToScreen
GetWindowDC
DefWindowProcW
OffsetRect
ReleaseDC
DrawTextA
GetDC
SetFocus
GetNextDlgTabItem
FillRect
GetWindowRect
SetWindowPos
EnableWindow
IsWindowEnabled
IsWindowVisible
GetSysColor
DestroyAcceleratorTable
DestroyIcon
LoadCursorW
ReleaseCapture
SetCapture
SetCursor
LoadStringW
DestroyCursor
SendMessageW
GetWindowLongW
GetParent
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
FindWindowExW
GetAsyncKeyState
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetWindowRgn
GetClientRect
GetSystemMetrics
MapVirtualKeyA
GetWindowInfo
IsWindow
GetWindowThreadProcessId
FindWindowA
GetWindowTextA
CharUpperW
CharLowerW
MessageBoxA
wsprintfA
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
CreateMDIWindowW
GetMenuDefaultItem
PeekMessageA
GetMessageA
ValidateRect
DispatchMessageA

shell32

DragQueryFileW
Shell_NotifyIconW
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileA

comctl32

ord17
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_Destroy
ImageList_Create
ImageList_BeginDrag
ImageList_Add
ImageList_EndDrag
InitCommonControlsEx

gdi32

DeleteDC
SetTextColor
SetBkMode
SetBkColor
GetStockObject
CreateSolidBrush
CreateRoundRectRgn
GetObjectW
BitBlt
SelectObject
CreateDIBSection
GetStretchBltMode
SetStretchBltMode
StretchBlt
CreateEllipticRgn
CreatePatternBrush
GetDIBits
TranslateCharsetInfo
CreateCompatibleDC
CreateFontIndirectW
GetDeviceCaps
CreateFontA
DeleteObject

gdiplus

GdipAddPathArcI
GdipAddPathEllipse
GdipAddPathPie
GdipAddPathPolygon
GdipAddPathPath
GdipAddPathString
GdipTransformPath
GdipGetPathWorldBounds
GdipFlattenPath
GdipWidenPath
GdipWindingModeOutline
GdipWarpPath
GdipIsVisiblePathPoint
GdipIsOutlineVisiblePathPoint
GdipCreateRegionRect
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionRect
GdipGetRegionScansCount
GdipGetRegionScans
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipGetFamilyName
GdipIsStyleAvailable
GdipGetEmHeight
GdipGetCellAscent
GdipGetCellDescent
GdipGetLineSpacing
GdipCreateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCloneBitmapArea
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipBitmapSetResolution
GdipCreateSolidFill
GdipAddPathLineI
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipCreateTexture
GdipFillRectangle
GdipDeleteBrush
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDisposeImage
GdipDeleteFont
GdiplusStartup
GdipDeletePath
GdipDeleteRegion
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawLineI
GdipDrawArcI
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCreateFromHDC
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipTranslateClip

atl

ord42

shlwapi

wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntExW

uxtheme

SetWindowTheme

crypt32

CryptStringToBinaryW

msimg32

AlphaBlend

ole32

CoUninitialize
CoInitialize
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

VariantTimeToSystemTime

advapi32

ReportEventA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegisterEventSourceA
DeregisterEventSource

ws2_32

gethostbyname
WSACleanup
closesocket
htonl
WSAStartup
ntohl
shutdown
connect
htons
setsockopt
WSAGetLastError
WSASocketW
WSASend
WSARecv

Exports

Exports

��_��

Sections

.text
Size: 688KB - Virtual size: 686KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfd1643675eaa70336cb1e28770df16d

Headers

File Characteristics

Imports

kernel32

user32

shell32

comctl32

gdi32

gdiplus

atl

shlwapi

uxtheme

crypt32

msimg32

ole32

oleaut32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 688KB - Virtual size: 686KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 104KB - Virtual size: 197KB

.rsrc Size: 4KB - Virtual size: 664B

.reloc Size: 32KB - Virtual size: 29KB

.text
Size: 688KB - Virtual size: 686KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 104KB - Virtual size: 197KB

.rsrc
Size: 4KB - Virtual size: 664B

.reloc
Size: 32KB - Virtual size: 29KB