blackmoon | 43635c6af2a3b34891a75e70eba00441

Sharing

Copy URL Twitter E-mail

General

Target

43635c6af2a3b34891a75e70eba00441
Size

238KB
MD5

43635c6af2a3b34891a75e70eba00441
SHA1

15561d61eaaa0977cb91c89c03835375f3162573
SHA256

f1130572f0a1c42d2d9811e9cc51ceb93d48ededf9fca172197aa32354c1e0e8
SHA512

cdd4e0200839816ccf4f5be6a41910d51492f4ff90913350dc69a6c3b5c75689ed2d9ca6b17bf5bbb3353c162ccc2df3472355de9ba7af760979db6f38c5ec1d
SSDEEP

3072:ORrKQP/EBnnZ1pD7ZCAmOLEBrkE3YkKXi3LAnU7e8WGKxST+tKC8xnz:ORrKS/CnZ1pD7ZC9JkEIkKXi3LTw6TP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Files

43635c6af2a3b34891a75e70eba00441
.exe windows:4 windows x86 arch:x86

abb0c704ddeeb2cc38422d03ee0733bb

Code Sign

55:21:db:26:ce:0c:b3:e4
Certificate

Issuer

CN=TrustAsia.com Code Signing CA,O=Dotsoft Technologies\, Inc.,C=CN

Not Before

01/03/2011, 01:07

Not After

01/03/2014, 01:07

Subject

CN=亚洲诚信数字签名测试证书,O=上海域联软件技术有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04
Certificate

Issuer

CN=TrustAsia.com Root CA,O=Dotsoft Technologies\, Inc.,C=CN

Not Before

15/02/2010, 16:37

Not After

15/02/2020, 16:37

Subject

CN=TrustAsia.com Code Signing CA,O=Dotsoft Technologies\, Inc.,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:a4:bf:0c:a3:ab:d5:4b:89:7b:b2:32:73:fe:a5:35:4f:1c:22:4b
Signer

Actual PE Digest

23:a4:bf:0c:a3:ab:d5:4b:89:7b:b2:32:73:fe:a5:35:4f:1c:22:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpyn
GlobalSize
GlobalFree
MultiByteToWideChar
lstrcpynA
CreatePipe
GetStartupInfoA
CreateProcessA
ReadFile
WriteFile
DeleteCriticalSection
SuspendThread
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
CreateFileA
CreateDirectoryA
MoveFileExA
RemoveDirectoryA
DeleteFileA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CopyFileA
SetFileAttributesA
WaitForSingleObject
GetTickCount
GetFileSize
SetFilePointer
FindNextFileA
FindFirstFileA
FindClose
WideCharToMultiByte
GetUserDefaultLCID
GetCurrentDirectoryA
GetCommandLineA
LCMapStringA
EnterCriticalSection
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
RaiseException
GetProcAddress
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
RtlUnwind
InterlockedIncrement
InterlockedDecrement
GetVersion
GetComputerNameA
GetSystemDirectoryA
GetWindowsDirectoryA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GlobalMemoryStatus
ResumeThread
Sleep
InitializeCriticalSection
GetCurrentProcessId
LocalSize
VirtualFree
GetLastError
GetQueuedCompletionStatus
CreateThread
CreateIoCompletionPort
GetTempPathA
TerminateProcess
OpenProcess
Module32First
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
RtlMoveMemory
GetDiskFreeSpaceA
GetDriveTypeA
GetVersionExA
GetSystemInfo

user32

RegisterClassExA
CreateWindowExA
LoadCursorA
LoadIconA
SetTimer
wsprintfA
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
IsWindowVisible
SetWindowLongA
DefWindowProcA
ShowWindowAsync
GetKeyState
keybd_event
mouse_event
SetCursorPos
GetDC
ReleaseDC
GetForegroundWindow
BringWindowToTop
SendMessageA
IsWindow
GetWindowRect
PrintWindow
FindWindowExA
GetWindowTextA
GetClassNameA
PeekMessageA
EnumDisplaySettingsA
GetWindowThreadProcessId
GetSystemMetrics

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

ws2_32

WSAStartup
closesocket
WSARecv
gethostbyname
WSACleanup
WSASocketA
inet_addr
htons
gethostname
connect
WSASend

shell32

SHGetPathFromIDList
SHGetSpecialFolderLocation
ShellExecuteA

advapi32

EnumServicesStatusExA
OpenSCManagerA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
ControlService
CloseServiceHandle
StartServiceA
QueryServiceStatus
OpenServiceA
RegCloseKey
GetUserNameA

gdi32

SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject
DeleteDC
CreateCompatibleBitmap
GetObjectA
GetDIBits
BitBlt

gdiplus

GdiplusStartup
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromStream
GdiplusShutdown

ole32

CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitialize
GetHGlobalFromStream
CreateStreamOnHGlobal
CLSIDFromString
OleRun

winmm

waveInStop
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInUnprepareHeader
waveInStart
waveInClose
waveInGetNumDevs

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

ntdll

RtlAdjustPrivilege
NtShutdownSystem

shlwapi

PathFileExistsA

oleaut32

VariantChangeType
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy

Sections

.text
Size: 184KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

abb0c704ddeeb2cc38422d03ee0733bb

Code Sign

55:21:db:26:ce:0c:b3:e4Certificate

Extended Key Usages

Key Usages

04Certificate

Extended Key Usages

Key Usages

23:a4:bf:0c:a3:ab:d5:4b:89:7b:b2:32:73:fe:a5:35:4f:1c:22:4bSigner

Headers

File Characteristics

Imports

kernel32

user32

version

ws2_32

shell32

advapi32

gdi32

gdiplus

ole32

winmm

avicap32

ntdll

shlwapi

oleaut32

Sections

.text Size: 184KB - Virtual size: 180KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 28KB - Virtual size: 82KB

.rsrc Size: 8KB - Virtual size: 5KB

55:21:db:26:ce:0c:b3:e4
Certificate

04
Certificate

23:a4:bf:0c:a3:ab:d5:4b:89:7b:b2:32:73:fe:a5:35:4f:1c:22:4b
Signer

.text
Size: 184KB - Virtual size: 180KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 28KB - Virtual size: 82KB

.rsrc
Size: 8KB - Virtual size: 5KB