blackmoon | cc6997c0a127a7380dde7e5609b3e46e66ac9e3267de5b702070031bcb0004cc

Sharing

Copy URL Twitter E-mail

General

Target

cc6997c0a127a7380dde7e5609b3e46e66ac9e3267de5b702070031bcb0004cc
Size

1.9MB
MD5

fc98303cbbfef1b96f52a24eb511bb5f
SHA1

3d9421ce1b144dc0b444a6a25728ddcad2ed659f
SHA256

cc6997c0a127a7380dde7e5609b3e46e66ac9e3267de5b702070031bcb0004cc
SHA512

eb34883768e56d73eb87a7d456b291b61d6d3344b55a0f2c1815a21f64d6525991d28c20ceed356da4fe238f1e6af5ec386fcf3bb77fcca89a09b06deec74697
SSDEEP

49152:JD/MMxUVLxI3zxFj6xJmIaMahFjIE1FRCRx7MzvEazj+H+1l/Ro9rp:cxI3zm/aPjP1/CTI6Hq7o91

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc6997c0a127a7380dde7e5609b3e46e66ac9e3267de5b702070031bcb0004cc

Files

cc6997c0a127a7380dde7e5609b3e46e66ac9e3267de5b702070031bcb0004cc
.dll windows:4 windows x86

a273274c2c5fe02ab9e9c29c60dfee00

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

PlaySoundA

kernel32

RaiseException
TerminateProcess
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
TlsGetValue
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
GetVersionExA
GetPrivateProfileStringA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
VirtualFreeEx
SetWaitableTimer
CreateWaitableTimerA
GetCurrentThreadId
CreateThread
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetTickCount
GetCurrentProcess
GetCurrentProcessId
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetOEMCP
GetCPInfo
RtlUnwind
SetFilePointer
WriteFile
GetProcessVersion
FindResourceA
LoadResource
LockResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
InterlockedIncrement
WritePrivateProfileStringA
GlobalFlags
MulDiv
GetVersion
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalFree
LocalAlloc
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
FlushFileBuffers

user32

GetClientRect
IsWindow
AdjustWindowRectEx
ModifyMenuA
GetSysColor
MapWindowPoints
UpdateWindow
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
PostThreadMessageA
DestroyMenu
CreateDialogIndirectParamA
EndDialog
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
SetForegroundWindow
SetActiveWindow
AttachThreadInput
SetWindowTextA
GetWindowTextW
GetWindowTextLengthW
GetParent
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
IsWindowVisible
EnumWindows
FindWindowExA
RegisterClassA
PostQuitMessage
PostMessageA
SendMessageA
SetCursor
EnableWindow
GetWindowLongA
IsWindowEnabled
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
ValidateRect
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
UnhookWindowsHookEx
UnregisterClassA
PtInRect
GetWindowRect
GetDlgCtrlID
GetWindow
ClientToScreen
GetMenuItemCount
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
SendDlgItemMessageA
IsDialogMessageA
SetWindowLongA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu

advapi32

RegCreateKeyExA
LookupPrivilegeValueA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
AdjustTokenPrivileges
OpenProcessToken

ole32

CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleRun
CoUninitialize
CoInitialize
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard

winhttp

WinHttpAddRequestHeaders
WinHttpCheckPlatform
WinHttpCrackUrl
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpOpenRequest
WinHttpSetCredentials
WinHttpCloseHandle
WinHttpSetOption
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData

ws2_32

htons
WSACleanup
inet_addr
closesocket
bind
listen
socket
WSAStartup
connect
send
recv
accept

gdi32

GetDeviceCaps
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetBkColor
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
CreateBitmap
GetStockObject
GetObjectA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

comctl32

ord17

oledlg

ord8

oleaut32

VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy

Exports

Exports

_send_hook
a

Sections

.text
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a273274c2c5fe02ab9e9c29c60dfee00

Headers

File Characteristics

Imports

winmm

kernel32

user32

advapi32

ole32

winhttp

ws2_32

gdi32

winspool.drv

comctl32

oledlg

oleaut32

Exports

Exports

Sections

.text Size: 212KB - Virtual size: 210KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 1.7MB - Virtual size: 1.7MB

.rsrc Size: 4KB - Virtual size: 664B

.reloc Size: 28KB - Virtual size: 24KB

.text
Size: 212KB - Virtual size: 210KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 1.7MB - Virtual size: 1.7MB

.rsrc
Size: 4KB - Virtual size: 664B

.reloc
Size: 28KB - Virtual size: 24KB