blackmoon | 18665086a6e2a3494967496040ee6aeedc0cb585d8dfc5b7d2e880a1b8186cd8

Sharing

Copy URL Twitter E-mail

General

Target

18665086a6e2a3494967496040ee6aeedc0cb585d8dfc5b7d2e880a1b8186cd8
Size

9.0MB
MD5

7d0cfd26d3ca5bf992d4ffbe2b44e759
SHA1

89c857e70e6eea732199b05b0cfba31fed50637a
SHA256

18665086a6e2a3494967496040ee6aeedc0cb585d8dfc5b7d2e880a1b8186cd8
SHA512

1bc1aa583866932b3c5d5b468c90895ddf9ac609afb6a830e09f29e6671f08110b46940b867af21f670e2bc2f9bff85ac18a033bc89af305accf6889280e190b
SSDEEP

98304:94zl5E/pRMqMzM0u2uFXOkBRMdxKxfC6Cd+BHdN5zu2+AXwJbVgSQ5ZuRQ6S5mFV:el5unMzDlyxjtdWtT+r5Zu/SiS/TSBg

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18665086a6e2a3494967496040ee6aeedc0cb585d8dfc5b7d2e880a1b8186cd8

Files

18665086a6e2a3494967496040ee6aeedc0cb585d8dfc5b7d2e880a1b8186cd8
.exe windows:5 windows x86 arch:x86

da961d0dbadc62e6f9ca16710333ea96

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

winmm

PlaySoundA

kernel32

GetLastError
GetCurrentProcess
GetVersionExA
TerminateProcess
OpenProcess
GetWindowsDirectoryA
lstrcpyA
GetSystemDirectoryA
lstrlenA
MultiByteToWideChar
GlobalAlloc
SetLastError
lstrcatA
SetFilePointer
GetVersion
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MulDiv
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
LocalFree
FlushFileBuffers
lstrcpynA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
InterlockedExchange
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryA
FreeLibrary
GetCommandLineA
MoveFileA
GetFileSize
ReadFile
DeleteFileA
SetFileAttributesA
CreateFileA
WriteFile
GetLocalTime
GetStartupInfoA
CreateProcessA
WaitForSingleObject
LCMapStringA
GetTickCount
Sleep
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
RtlMoveMemory
MoveFileExA
GetTempFileNameA
GetTempPathA
Process32Next
Process32First
GetProcAddress
ResumeThread
SetProcessWorkingSetSize
Module32First
CreateToolhelp32Snapshot
SuspendThread
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
WideCharToMultiByte
VirtualProtect
GetModuleHandleA
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
SetCursor
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
IsWindowEnabled
EnableWindow
UnregisterHotKey
ScreenToClient
RegisterHotKey
LoadBitmapA
GetSysColor
CreateWindowExA
CallWindowProcA
PtInRect
GetWindowLongA
GetCursorPos
SetWindowLongA
GetDlgItem
ShowWindow
SystemParametersInfoA
GetDC
SendMessageA
ReleaseCapture
SetCapture
GetSystemMetrics
GetMenuItemCount
SetWindowTextA
GetDlgCtrlID
DestroyWindow
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
ReleaseDC
GetWindowDC
GetForegroundWindow
BringWindowToTop
UpdateWindow
MoveWindow
GetParent
GetWindowRect
SetWindowPos
GetClassNameA
GetWindowTextA
IsWindowVisible
GetWindow
GetDesktopWindow
FindWindowExA
SendInput
GetAsyncKeyState
MsgWaitForMultipleObjects
ClientToScreen
GetClientRect
GetWindowThreadProcessId
FindWindowA
GetFocus
UnregisterClassA
CharUpperBuffW

gdi32

SetWindowExtEx
ScaleWindowExtEx
GetClipBox
CreateBitmap
TranslateCharsetInfo
CreateFontA
GetDeviceCaps
SelectObject
Escape
ExtTextOutA
ScaleViewportExtEx
RectVisible
PtVisible
GetObjectA
GetStockObject
DeleteDC
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
RestoreDC
TextOutA
SaveDC
DeleteObject

advapi32

RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA

ole32

CoInitialize

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

shell32

SHGetSpecialFolderPathA
DragQueryFileA
DragFinish
DragAcceptFiles

comctl32

ord17
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag

Sections

.text
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da961d0dbadc62e6f9ca16710333ea96

Headers

File Characteristics

Imports

shlwapi

winmm

kernel32

user32

gdi32

advapi32

ole32

winspool.drv

shell32

comctl32

Sections

.text Size: 272KB - Virtual size: 270KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 2.2MB - Virtual size: 2.3MB

Size: 4.3MB - Virtual size: 4.3MB

Size: 4KB - Virtual size: 1KB

Size: 2.2MB - Virtual size: 2.2MB

.rsrc Size: 4KB - Virtual size: 616B

.text
Size: 272KB - Virtual size: 270KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 2.2MB - Virtual size: 2.3MB

.rsrc
Size: 4KB - Virtual size: 616B