blackmoon | 8a0f375a7b302382caefbe97e4b9258d2f0baefa9c6ccbfe255f68e5ea1cc0d2

Sharing

Copy URL Twitter E-mail

General

Target

8a0f375a7b302382caefbe97e4b9258d2f0baefa9c6ccbfe255f68e5ea1cc0d2
Size

3.6MB
MD5

24220c7ee36d7b284349d4179b2d659d
SHA1

7f8d492cdfc05075279db45aa9e63fff48d7e2e1
SHA256

8a0f375a7b302382caefbe97e4b9258d2f0baefa9c6ccbfe255f68e5ea1cc0d2
SHA512

714a2431c80519f32050d5485bcda63355f5e31ae45caaadfb21bbd119a3d3e1f19462f807fa1dfb9694c3547b9028e2479aa3484d464a34015e4dab652551e1
SSDEEP

49152:OmxjOsXpjYoJWME6PICVKkKxyCRbwlMF/gHdfZXl:JNZjvJWME6PRKGvV

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a0f375a7b302382caefbe97e4b9258d2f0baefa9c6ccbfe255f68e5ea1cc0d2

Files

8a0f375a7b302382caefbe97e4b9258d2f0baefa9c6ccbfe255f68e5ea1cc0d2
.exe windows:4 windows x86 arch:x86

29f89a8bb979447327bbe790b35b961e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryA
LCMapStringA
RtlFillMemory
GetProcAddress
RtlMoveMemory
GetVersion
LCMapStringW
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
GetOEMCP
ExitProcess
GetCPInfo
SetFilePointer
CloseHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
RaiseException
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
GetCommandLineA
GetModuleFileNameA
GetACP
FreeLibrary
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetProcessHeap
ResumeThread
CreateSemaphoreA
PostQueuedCompletionStatus
SuspendThread
TerminateThread
GetQueuedCompletionStatus
CreateIoCompletionPort
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
GetACP
HeapSize
ReleaseSemaphore
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RaiseException
ExitThread
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GetProfileIntA
GlobalFlags
GetCurrentThread
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
DuplicateHandle
lstrcpynA
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
LocalFree
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
ReadFile
lstrlenW
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
ResetEvent
Sleep
OutputDebugStringA
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
GetFileAttributesA
CopyFileA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
TerminateProcess

user32

MessageBoxA
TranslateMessage
GetMessageA
PeekMessageA
DispatchMessageA
wsprintfA
GetSysColorBrush
LoadStringA
wvsprintfA
GetDesktopWindow
GetClassNameA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
IsDialogMessageA
SetRectEmpty
DispatchMessageA
ScrollWindowEx
SendDlgItemMessageA
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
MapWindowPoints
AdjustWindowRectEx
ScrollWindow
GetScrollInfo
GetMessageA
WindowFromPoint
DrawFocusRect
UnregisterClassA
DrawEdge
DrawFrameControl
TranslateMessage
LoadIconA
GetCursor
DrawTextA
SetPropA
CallWindowProcA
MoveWindow
GetPropA
FrameRect
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
GetWindowDC
EnumChildWindows
WindowFromDC
TabbedTextOutA
GrayStringA
DrawStateA
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetTabbedTextExtentA
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
CreatePopupMenu
SetScrollInfo
ShowScrollBar
GetScrollPos
RegisterClassA
CreateWindowExA
GetClassLongA
RemovePropA
GetMessageTime
GetLastActivePopup
GetForegroundWindow
RegisterWindowMessageA
GetWindowPlacement
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
EndPaint
BeginPaint
CharUpperA
GetWindowTextLengthA
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
InvertRect
IsRectEmpty
ReleaseDC
IsChild
TrackPopupMenu
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBeep
MessageBoxA
GetCursorPos
GetSystemMetrics
IsClipboardFormatAvailable
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
DrawIconEx
CreateIconFromResource
CreateIconFromResourceEx
GetActiveWindow
RegisterClipboardFormatA
GetMenuState
GetMenuStringA
GetMenuItemID
GetMenuItemCount
SetWindowTextA
GetWindowTextA
ClipCursor
GetWindowTextLengthW
SetWindowTextW
CreateWindowExW
SetWindowLongW
CallWindowProcW
SendMessageW
GetWindowTextW
GetDoubleClickTime
DrawTextW
MsgWaitForMultipleObjects
GetKeyState
DefWindowProcW

gdi32

GetViewportExtEx
ExtSelectClipRgn
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetPolyFillMode
SetPixelV
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
GetROP2
GetBkColor
GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
SetPixel
CreateRectRgnIndirect
SetBkColor
SetBkMode
SetTextColor
SetWindowOrgEx
SaveDC
RestoreDC
CreatePenIndirect
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
AbortDoc
CreateFontA
SetBrushOrgEx
GetTextExtentPoint32W
GetTextMetricsW
SetBitmapBits
GetBitmapBits
MoveToEx
LineTo
CopyMetaFileA
CreateCompatibleDC
GetPixel
BitBlt
StartPage
StartDocA
DeleteDC
EndDoc
EndPage
GetObjectA
GetStockObject
CreateFontIndirectA
CreateSolidBrush
FillRgn
CreateRectRgn
CombineRgn
PatBlt
CreatePen
SelectObject
CreatePatternBrush
CreateBitmap
CreateBrushIndirect
CreateDCA
CreateCompatibleBitmap
GetPolyFillMode
GetTextMetricsA
GetStretchBltMode

winmm

midiOutPrepareHeader
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
midiStreamProperty
midiStreamOut
midiStreamStop
midiOutReset
midiStreamClose
midiStreamRestart
midiStreamOpen

msimg32

GradientFill

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegQueryValueExA

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

OleIsCurrentClipboard
OleGetClipboard
DoDragDrop
CoLockObjectExternal
RevokeDragDrop
OleDuplicateData
CoTaskMemAlloc
OleSetClipboard
CoTaskMemFree
ReleaseStgMedium
CLSIDFromProgID
OleInitialize
OleUninitialize
CLSIDFromString
CreateStreamOnHGlobal
CoCreateInstance
OleRun
OleFlushClipboard

oleaut32

VarDateFromStr
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayPutElement
SafeArrayCreate
SafeArrayDestroy
SysAllocString
VariantInit
VariantCopyInd
SafeArrayGetElement
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
VariantCopy
UnRegisterTypeLi

comctl32

ImageList_GetImageCount
ImageList_AddMasked
ImageList_GetImageInfo
ImageList_Draw
ImageList_GetIcon
ImageList_SetBkColor
ord17
ImageList_Destroy
ImageList_Create
ImageList_Read
ImageList_Write
ImageList_DrawIndirect
_TrackMouseEvent
ImageList_Duplicate

ws2_32

WSAAsyncSelect
closesocket
WSACleanup
recvfrom
ioctlsocket
recv
getpeername
accept
inet_ntoa

comdlg32

GetOpenFileNameA
GetSaveFileNameA
PrintDlgA
GetFileTitleA
ChooseColorA

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 525KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29f89a8bb979447327bbe790b35b961e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 200KB - Virtual size: 525KB

.rsrc Size: 80KB - Virtual size: 79KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 200KB - Virtual size: 525KB

.rsrc
Size: 80KB - Virtual size: 79KB