blackmoon | 171243770d6a8490798cbbab2d093a834c3622020c9437b03364717e4a4d21e9

Sharing

Copy URL Twitter E-mail

General

Target

171243770d6a8490798cbbab2d093a834c3622020c9437b03364717e4a4d21e9
Size

4.9MB
MD5

faa1579ed19c3605ab885ced0377cb7f
SHA1

a817172d409701770b957665305d60682b8bcb38
SHA256

171243770d6a8490798cbbab2d093a834c3622020c9437b03364717e4a4d21e9
SHA512

44645567f90912a0466dc630836d56e2f92c859b76e50898cfd46c8ba01f1fed1159b5ee8c3fcd612f5e1fbb01cc5c6c34299c8ce8924c39f4a75872d15c066e
SSDEEP

49152:Alb598ZmobwkxStbJUujJOn+t4sveMQLtSfb6++h2NSbDeZeyS:Yb/krHKJUuA+5v2LtS2bDnyS

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
171243770d6a8490798cbbab2d093a834c3622020c9437b03364717e4a4d21e9

Files

171243770d6a8490798cbbab2d093a834c3622020c9437b03364717e4a4d21e9
.dll windows:4 windows x86

979de1ecd0e069448e333e4b7fba785f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAStartup
inet_ntoa
WSACleanup
accept
listen
bind
htons
getsockname
ioctlsocket
socket
closesocket
connect
inet_addr
__WSAFDIsSet
select
recv
send
ntohs
shutdown
htonl
gethostname
WSAGetLastError
gethostbyname

kernel32

GetTempPathA
GetVersionExA
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LoadLibraryA
FreeLibrary
GetCommandLineA
GetPrivateProfileStringA
LCMapStringA
FindFirstFileA
SetFilePointer
SetEndOfFile
SetFileAttributesA
GetLocalTime
GetTickCount
GetEnvironmentVariableA
FormatMessageA
GetUserDefaultLCID
GetFileSize
ReadFile
WritePrivateProfileStringA
HeapReAlloc
ExitProcess
IsBadStringPtrA
LocalSize
GlobalSize
TerminateThread
QueryDosDeviceW
CreateProcessA
lstrcpyA
VirtualQueryEx
SetPriorityClass
OpenProcess
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
IsBadReadPtr
CreateFileMappingA
FindClose
FindFirstFileW
WriteFile
CreateFileW
CreateThread
DeleteFileA
LocalFree
CreateDirectoryW
LocalAlloc
lstrlenW
Sleep
GetExitCodeThread
ReadProcessMemory
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
RtlMoveMemory
GetComputerNameA
GetVolumeInformationA
DeviceIoControl
lstrcpyn
CreateFileA
CreateEventA
OpenEventA
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
VirtualFree
VirtualAlloc
CloseHandle
TerminateProcess
GetWindowsDirectoryA
WideCharToMultiByte
HeapAlloc
GetModuleFileNameA
VirtualQuery
GetModuleHandleA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
MultiByteToWideChar
GetNativeSystemInfo
GetProcAddress
GetModuleHandleW
GetProcessHeap
lstrlenA
GetCurrentThreadId
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LCMapStringW
UnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
GetSystemTime
ExitThread
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
lstrcpynA
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
MulDiv
GetVersion
GetTimeZoneInformation
DeleteCriticalSection
GetSystemDirectoryA
SetLastError
lstrcatA
GetLastError

user32

LoadCursorW
SetClipboardData
CloseClipboard
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
RegisterClassExW
DefWindowProcW
SystemParametersInfoA
MessageBoxTimeoutA
CopyImage
MsgWaitForMultipleObjects
CreateWindowExW
SendMessageW
GetClassNameW
EmptyClipboard
OpenClipboard
PeekMessageA
GetMessageA
SetForegroundWindow
SetWindowPos
CallWindowProcA
ShowWindow
IsWindowVisible
FindWindowExA
GetForegroundWindow
GetDesktopWindow
GetWindow
GetClassNameA
GetWindowTextLengthA
DispatchMessageA
wsprintfA
SetClassLongA
GetClassLongA
SetRect
MessageBoxA
SetWindowTextA
EnableWindow
IsWindowEnabled
GetWindowTextA
IsWindow
GetWindowRect
MoveWindow
SetActiveWindow
MessageBeep
GetPropA
GetMessageW
TranslateMessage
DispatchMessageW
RemovePropA
PostMessageW
SetTimer
GetAsyncKeyState
DestroyWindow
GetWindowThreadProcessId
CreatePopupMenu
AppendMenuA
TrackPopupMenuEx
DestroyMenu
SetCursor
SendMessageA
KillTimer
IntersectRect
InvalidateRect
UpdateLayeredWindow
ReleaseCapture
LoadCursorFromFileW
IsZoomed
IsIconic
PtInRect
SetParent
PostMessageA
UpdateWindow
ValidateRect
GetSystemMetrics
SetWindowRgn
GetParent
ReleaseDC
SetCaretPos
GetCursorPos
CallWindowProcW
TrackMouseEvent
GetClientRect
GetDlgItem
GetWindowLongA
CreateWindowExA
DestroyCursor
SetWindowLongA
LoadCursorA
ScreenToClient
GetSysColor
LoadBitmapA
RegisterHotKey
UnregisterHotKey
GetActiveWindow
PostQuitMessage
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetKeyState
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
CreateDialogIndirectParamA
EndDialog
UnregisterClassA
GetDlgCtrlID
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
RegisterWindowMessageA
GetMessagePos
GetMessageTime
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetWindowTextW
AdjustWindowRectEx
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
PostThreadMessageA
GetClassLongW
SetPropA
SetWindowLongW
SetFocus
GetDC
DefMDIChildProcA
GetFocus
BeginPaint
EndPaint
SetCapture
DefWindowProcA

shlwapi

PathFindExtensionA
PathFileExistsA
PathIsDirectoryW
StrToIntExA
PathFindFileNameA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

gdi32

SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetDeviceCaps
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateRoundRectRgn
CreateRectRgn
GetDIBits
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
TranslateCharsetInfo
BitBlt
CreateCompatibleDC
CreateDIBSection
SelectObject
GetStockObject
GetObjectA
ExtCreateRegion
CombineRgn
CreateSolidBrush
CreateFontA
DeleteDC
SetViewportOrgEx

comdlg32

GetOpenFileNameA
ChooseColorA

advapi32

RegSetValueExA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey

shell32

DragAcceptFiles
DragFinish
DragQueryFileA
Shell_NotifyIconW
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetSpecialFolderPathA

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CLSIDFromString
StringFromGUID2
CLSIDFromProgID
CoCreateInstance
CoRevokeClassObject
OleRun

wininet

InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetSetOptionA
InternetOpenA

gdiplus

GdipImageSelectActiveFrame
GdipCreateHBITMAPFromBitmap
GdipGetCompositingQuality
GdiplusStartup
GdipCreateImageAttributes
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipCreatePathGradientFromPath
GdipDrawPolygon
GdipFillPolygon
GdipCreatePen2
GdipDeleteFont
GdipGetFamilyName
GdipGetFontSize
GdipGetFontStyle
GdipMeasureString
GdipGetImagePixelFormat
GdipCloneBitmapArea
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRect
GdipDisposeImage
GdipSetClipRegion
GdipSetClipRect
GdipDrawRectangle
GdipDeletePen
GdipSetPenDashStyle
GdipResetClip
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipCreateStringFormat
GdipSetStringFormatHotkeyPrefix
GdipDeleteStringFormat
GdipGraphicsClear
GdipCreateLineBrushFromRect
GdipFillRectangle
GdipDeleteBrush
GdipGetFontHeight
GdipCreateSolidFill
GdipDrawString
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSetCompositingQuality
GdipSetInterpolationMode
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipGetStringFormatAlign
GdipGetStringFormatTrimming
GdipCreateLineBrush
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageRect
GdipGetStringFormatFlags
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipLoadImageFromStream
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSetStringFormatMeasurableCharacterRanges
GdipCreateRegion
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipFillPath
GdipClosePathFigure
GdipAddPathArc
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipCreateRegionHrgn
GdipDeleteRegion

atl

ord42

oleaut32

SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
SysFreeString
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
SafeArrayDestroy
VarR8FromBool
VarR8FromCy
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
OleLoadPicture
VariantCopy
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
LoadTypeLi
SafeArrayGetUBound

psapi

GetModuleFileNameExA
GetProcessImageFileNameW

imm32

ImmGetContext
ImmAssociateContext

iphlpapi

GetAdaptersInfo

oledlg

ord8

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comctl32

ImageList_Add
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ImageList_BeginDrag

Exports

Exports

Happy

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.4MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

979de1ecd0e069448e333e4b7fba785f

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

shlwapi

version

gdi32

comdlg32

advapi32

shell32

ole32

wininet

gdiplus

atl

oleaut32

psapi

imm32

iphlpapi

oledlg

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 2.4MB - Virtual size: 2.6MB

.rsrc Size: 4KB - Virtual size: 828B

.reloc Size: 108KB - Virtual size: 107KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 2.4MB - Virtual size: 2.6MB

.rsrc
Size: 4KB - Virtual size: 828B

.reloc
Size: 108KB - Virtual size: 107KB