Behavioral task
behavioral1
Sample
4e82f832520dc2707893158e1abeb9a18a5f8fcb6fd32432c1c6ed1d422b7b3c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
4e82f832520dc2707893158e1abeb9a18a5f8fcb6fd32432c1c6ed1d422b7b3c.exe
Resource
win10v2004-20231023-en
General
-
Target
4e82f832520dc2707893158e1abeb9a18a5f8fcb6fd32432c1c6ed1d422b7b3c
-
Size
640KB
-
MD5
15f15991fba07eaa67f5f98179b27886
-
SHA1
6910653d078a7f9a5f6a3b2f2d8b0da64bc31bde
-
SHA256
4e82f832520dc2707893158e1abeb9a18a5f8fcb6fd32432c1c6ed1d422b7b3c
-
SHA512
34010878b9a8c6724f10fe85b7c3e65ef154ef106019b2280d32f54fd2eb677464b2cf7393d89dbc19e0c79c55c08feb11aa120e4a6d84bfe33fd491587fc16d
-
SSDEEP
12288:Y3X3ybRxUcJ9RVqpiR/AeYAsNPk6YR/aT0pAMmS+wWt/qy3zotuiX5d:Y3Sb/UcJ9TqpiR/AZAsNPk6YR/aT0pA8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e82f832520dc2707893158e1abeb9a18a5f8fcb6fd32432c1c6ed1d422b7b3c
Files
-
4e82f832520dc2707893158e1abeb9a18a5f8fcb6fd32432c1c6ed1d422b7b3c.exe windows:4 windows x86 arch:x86
0ae296ad9f0dc12fec2c56c14d4ba2ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
FreeLibrary
GetCommandLineA
GlobalFree
GetUserDefaultLCID
DeleteFileA
Sleep
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
GetTickCount
GetModuleFileNameA
HeapReAlloc
ExitProcess
VirtualProtect
GlobalUnlock
GlobalLock
GlobalAlloc
RtlZeroMemory
GetAtomNameW
GetModuleFileNameW
GetModuleHandleW
Module32Next
GetProcessHeap
GetCurrentProcessId
lstrcpyn
CloseHandle
LocalFree
LocalAlloc
InterlockedDecrement
SetStdHandle
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetOEMCP
GetCPInfo
OpenProcess
GetCurrentProcess
SetErrorMode
RtlMoveMemory
LoadLibraryA
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
GetSystemDirectoryA
GetWindowsDirectoryA
FlushFileBuffers
SetFilePointer
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
Module32First
CreateToolhelp32Snapshot
GetProcessTimes
CreateThread
CreateRemoteThread
GetCurrentDirectoryA
GetCommandLineW
IsBadCodePtr
IsBadReadPtr
lstrcatA
GetEnvironmentVariableA
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
HeapAlloc
HeapFree
GlobalFindAtomA
SetLastError
lstrcpyA
WritePrivateProfileStringA
GlobalFlags
MulDiv
lstrcpynA
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
InterlockedIncrement
GetLastError
LocalSize
VirtualQuery
user32
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
SetActiveWindow
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
SetWindowLongA
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
DrawTextA
TabbedTextOutA
UnhookWindowsHookEx
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
PtInRect
GetClassNameA
RegisterClipboardFormatA
LoadBitmapA
ModifyMenuA
LoadCursorW
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
GetCursorPos
SetWindowsHookExA
UpdateWindow
GetWindowLongA
SendMessageA
PostMessageA
GetDC
ReleaseDC
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
DrawIconEx
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
GetClassNameW
FindWindowExW
IsWindow
GetAsyncKeyState
ValidateRect
InvalidateRect
MessageBoxW
SetWindowTextW
SetParent
GetMenuCheckMarkDimensions
MoveWindow
SetWindowLongW
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
GetWindowTextLengthW
GetWindowTextW
DestroyIcon
DestroyAcceleratorTable
GetParent
GetWindowLongW
SendMessageW
DestroyCursor
GetSysColor
IsWindowVisible
IsWindowEnabled
EnableWindow
MessageBoxTimeoutA
SetWindowRgn
SetCursor
GetClientRect
SetCapture
SetWindowPos
GetWindowRect
SendMessageTimeoutA
ExitWindowsEx
GetFocus
SetFocus
GetMessageW
GetLastActivePopup
ReleaseCapture
ScreenToClient
GetIconInfo
CopyIcon
PostMessageW
ShowWindow
DefWindowProcW
CallWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsChild
PostQuitMessage
GetNextDlgTabItem
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
SetMenuItemBitmaps
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
LookupAccountSidA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ole32
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
StringFromGUID2
GetHGlobalFromStream
CLSIDFromString
OleRun
CoCreateInstance
CLSIDFromProgID
wininet
InternetTimeToSystemTime
shell32
CommandLineToArgvW
Shell_NotifyIconW
DragFinish
DragQueryFileW
DragAcceptFiles
gdi32
GetDIBits
CreatePatternBrush
CreateSolidBrush
CreateEllipticRgn
CreateFontIndirectW
GetStockObject
GetObjectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
DeleteDC
SelectObject
DeleteObject
GetObjectA
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
gdiplus
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetImageAttributesOutputChannelColorProfile
GdipDeletePath
GdipDeleteFont
GdiplusStartup
GdipDisposeImage
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdipSetImageAttributesRemapTable
GdipSetImageAttributesWrapMode
GdipDeleteRegion
GdipGetImageAttributesAdjustedPalette
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipFlush
GdipGetDC
GdipReleaseDC
GdipCreateImageAttributes
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipSetSmoothingMode
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipCombineRegionRegion
psapi
GetModuleFileNameExA
shlwapi
PathRemoveFileSpecW
PathFindExtensionA
PathFindFileNameA
PathFindFileNameW
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
atl
ord42
comctl32
ord17
InitCommonControlsEx
msimg32
AlphaBlend
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
oledlg
ord8
oleaut32
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayAccessData
Sections
.text Size: 452KB - Virtual size: 448KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 144KB - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ