blackmoon | e9349ef87cb52483527af14098b86571c0f9a554434236e1acf202c61253e2d3

Sharing

Copy URL Twitter E-mail

General

Target

e9349ef87cb52483527af14098b86571c0f9a554434236e1acf202c61253e2d3
Size

144KB
MD5

0cd2c609395cf8c5f244dcc683503e41
SHA1

11f85c2c9bbbc2802b36e9a80e12ee383955a882
SHA256

e9349ef87cb52483527af14098b86571c0f9a554434236e1acf202c61253e2d3
SHA512

f160a5ea538753f87a33d8226c9784987efe696e7ed0a60cdbfd70f424448015011344d0a85c83b3a96194fd08c3cebbd6ccc4ef24a4652f7fc0a77416a23a35
SSDEEP

3072:0hgR18F5weFfKeQfnLmLh2flElVaOPIGrvviBr7:0EVg2OmOTTvOr7

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9349ef87cb52483527af14098b86571c0f9a554434236e1acf202c61253e2d3

Files

e9349ef87cb52483527af14098b86571c0f9a554434236e1acf202c61253e2d3
.exe windows:4 windows x86 arch:x86

b0d116cff352a5195271a0d1f0866a5f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableW
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetThreadPriority
ExitProcess
IsDebuggerPresent
LocalAlloc
LocalFree
IsBadReadPtr
IsBadCodePtr
OpenProcess
CloseHandle
GetProcessHeap
GetModuleHandleA
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
GetTickCount
FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
GetModuleFileNameW
Sleep
WaitForSingleObject
CreateProcessA
GetStartupInfoA
WriteFile
CreateFileA
SetFileAttributesA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
lstrcpyn
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
MoveFileA
GetUserDefaultLCID
CreateDirectoryA

user32

GetMessageA
PeekMessageA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage

shell32

SHChangeNotify
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathA

ole32

CLSIDFromString
OleRun
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CLSIDFromProgID
CoInitialize

wininet

HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA

winhttp

WinHttpSetCredentials
WinHttpCheckPlatform
WinHttpCrackUrl
WinHttpOpen
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpCloseHandle
WinHttpConnect
WinHttpOpenRequest

oleaut32

VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VarR8FromBool
VarR8FromCy

msvcrt

__CxxFrameHandler
strncmp
memmove
modf
realloc
strrchr
srand
_ftol
atoi
_CIfmod
malloc
free
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
_stricmp

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0d116cff352a5195271a0d1f0866a5f

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

wininet

winhttp

oleaut32

msvcrt

Sections

.text Size: 125KB - Virtual size: 125KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 13KB - Virtual size: 86KB

.rsrc Size: 1024B - Virtual size: 732B

.text
Size: 125KB - Virtual size: 125KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 13KB - Virtual size: 86KB

.rsrc
Size: 1024B - Virtual size: 732B