blackmoon | 9502de0eb1d4e477276ad5408c38a84d184ccf826af350859e7d956eaa72785e

Sharing

Copy URL Twitter E-mail

General

Target

9502de0eb1d4e477276ad5408c38a84d184ccf826af350859e7d956eaa72785e
Size

368KB
MD5

2f3f69268590d83cc2759303fa65a55a
SHA1

bf18a60ffa32a875756b761b2480fa5e32a15d96
SHA256

9502de0eb1d4e477276ad5408c38a84d184ccf826af350859e7d956eaa72785e
SHA512

7688ea998f1899cd2d0cf629f4bdabfbfbf6cdd83b0a63a823a4c51934da44dec3e759809654d4f254c47ddc4a91424d2b4a7a08357ff82210ac50d6afaf95a5
SSDEEP

6144:8EU+NU6PAMC0G439fRZyofYDbKMd6pNF75QSqt:NU+NUUAMC0dJZxfYDbKMd6R7

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9502de0eb1d4e477276ad5408c38a84d184ccf826af350859e7d956eaa72785e

Files

9502de0eb1d4e477276ad5408c38a84d184ccf826af350859e7d956eaa72785e
.dll windows:4 windows x86 arch:x86

29d0e7ddec2c9cb9664c081dd632b00c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetCommandLineA
GetFileSize
ReadFile
LCMapStringA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStringA
GetModuleFileNameA
HeapReAlloc
ExitProcess
IsBadCodePtr
VirtualFreeEx
LocalSize
SetStdHandle
SetUnhandledExceptionFilter
LCMapStringW
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleHandleA
TerminateThread
UnmapViewOfFile
RtlMoveMemory
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
TerminateProcess
HeapAlloc
GetProcessHeap
SetWaitableTimer
CreateWaitableTimerA
GetCurrentProcess
IsBadReadPtr
VirtualProtect
CreateThread
CloseHandle
DeviceIoControl
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
RtlUnwind
CreateFileA
GetWindowsDirectoryA
GetOEMCP
GetCPInfo
FlushFileBuffers
SetFilePointer
WriteFile
GetProcessVersion
FindResourceA
LoadResource
LockResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
InterlockedIncrement
WritePrivateProfileStringA
GlobalFlags
MulDiv
GetVersion
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTickCount
Sleep
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
lstrlenA
LocalAlloc
LocalFree
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue

user32

GetAsyncKeyState
GetClientRect
DestroyWindow
DefWindowProcA
CallWindowProcA
DefMDIChildProcA
LoadCursorA
SetCursor
TrackMouseEvent
DestroyIcon
PostQuitMessage
SetWindowLongA
DestroyCursor
EndPaint
BeginPaint
MessageBoxTimeoutA
MsgWaitForMultipleObjects
SendMessageA
PeekMessageA
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
CreateWindowExA
GetWindowLongA
GetDlgItem
IsWindow
GetClassNameA
SetFocus
GetFocus
GetWindowRect
GetParent
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetWindowPos
PostMessageA
SetParent
IsWindowVisible
ShowWindow
IsWindowEnabled
EnableWindow
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
MessageBoxA
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
UnhookWindowsHookEx
UnregisterClassA
PtInRect
GetDlgCtrlID
GetWindow
ClientToScreen
GetDC
ReleaseDC
TabbedTextOutA
DrawTextA
GrayStringA
SendDlgItemMessageA
GetWindowPlacement
SystemParametersInfoA
GetForegroundWindow
GetMessagePos
GetMessageTime
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
PostThreadMessageA
CreateDialogIndirectParamA
EndDialog
InsertMenuA
GetMenuItemCount
AppendMenuA
DestroyMenu
LoadMenuA
GetSystemMenu
CreatePopupMenu
CreateMenu
KillTimer
SetTimer
RegisterClassExA
SetActiveWindow
DispatchMessageA
TranslateMessage
IsDialogMessageA
TranslateAcceleratorA
GetMessageA
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
FillRect
SetClassLongA
GetClassLongA
SetRect
SetWindowRgn
RemovePropA
GetPropA
SetPropA

gdi32

DeleteObject
CreateBitmap
SaveDC
RestoreDC
CreateCompatibleDC
GetStockObject
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetObjectA
CreateDIBSection
DeleteDC
SelectObject
BitBlt
ExtCreateRegion
CombineRgn
CreateRoundRectRgn
StretchBlt
CreateSolidBrush
CreatePatternBrush
SetBkColor
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps

advapi32

RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA

shell32

DragFinish
Shell_NotifyIconA
DragAcceptFiles
DragQueryFileA

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard

wininet

InternetOpenA
InternetConnectA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
InternetTimeToSystemTime

atl

ord42

oledlg

ord8

oleaut32

VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy

ws2_32

closesocket
select
__WSAFDIsSet
send
htons
WSACleanup
gethostbyname
recv
shutdown
connect
inet_addr
socket
inet_ntoa
WSAStartup
WSAGetLastError
ioctlsocket

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

comctl32

ord17

Exports

Exports

KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode

Sections

.text
Size: 284KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29d0e7ddec2c9cb9664c081dd632b00c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

atl

oledlg

oleaut32

ws2_32

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 284KB - Virtual size: 282KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 28KB - Virtual size: 108KB

.rsrc Size: 4KB - Virtual size: 824B

.reloc Size: 24KB - Virtual size: 22KB

.text
Size: 284KB - Virtual size: 282KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 28KB - Virtual size: 108KB

.rsrc
Size: 4KB - Virtual size: 824B

.reloc
Size: 24KB - Virtual size: 22KB