Behavioral task
behavioral1
Sample
d3073fc7ae08e21470417479189044d829df17f73efbe5548bb2bfee2a85f120.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d3073fc7ae08e21470417479189044d829df17f73efbe5548bb2bfee2a85f120.exe
Resource
win10v2004-20231215-en
General
-
Target
d3073fc7ae08e21470417479189044d829df17f73efbe5548bb2bfee2a85f120
-
Size
3.0MB
-
MD5
8b7b076a4214886f451ddd0adcc147fe
-
SHA1
37e22bd24aa90680fb05723a8a32f6103eb80f05
-
SHA256
d3073fc7ae08e21470417479189044d829df17f73efbe5548bb2bfee2a85f120
-
SHA512
328f90dadb7d6bdaa5f677473939b2bff4d5354b4e4413fa4b373fbf9e9b96fe019cc85e53c59428aa4b4437a804b97276852fb806939274debefcf0c80b9fc2
-
SSDEEP
49152:CLw7AjC+m3f3hegoGslrCdCS7OqoCPZiJ4Wg6s8DU:Q0AUJeduLPMjA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d3073fc7ae08e21470417479189044d829df17f73efbe5548bb2bfee2a85f120
Files
-
d3073fc7ae08e21470417479189044d829df17f73efbe5548bb2bfee2a85f120.exe windows:4 windows x86 arch:x86
d38ebce52b74dbbec00b746a6e947d76
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpynA
RtlMoveMemory
TerminateProcess
CloseHandle
GetTickCount
GetProcAddress
VirtualAlloc
GetVolumeInformationA
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeThread
TerminateThread
CreateMutexA
WaitForSingleObject
VirtualFree
LCMapStringA
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LoadLibraryA
FreeLibrary
GetCommandLineA
FormatMessageA
GetUserDefaultLCID
GetFileSize
RemoveDirectoryA
SetFileAttributesA
DeleteFileA
WriteFile
GetLocalTime
GetModuleFileNameA
FindClose
FindFirstFileA
FindNextFileA
ReadFile
SetFilePointer
Sleep
IsBadReadPtr
HeapReAlloc
ExitProcess
VirtualProtect
Module32Next
Module32First
CreateRemoteThread
GetProcessTimes
GetCurrentProcess
DeviceIoControl
CreateFileA
lstrcmpW
RtlZeroMemory
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
GetModuleFileNameW
GetCommandLineW
IsBadStringPtrA
GlobalSize
lstrcatW
lstrcmpiW
lstrcmpA
UnhandledExceptionFilter
HeapSize
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcpyA
lstrcatA
WritePrivateProfileStringA
GlobalFlags
MulDiv
IsDebuggerPresent
LocalReAlloc
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalFree
GlobalDeleteAtom
GetCurrentThread
FlushFileBuffers
SetStdHandle
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
RaiseException
IsBadWritePtr
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
lstrlenA
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
SetErrorMode
GetSystemDirectoryA
GetWindowsDirectoryA
GetLastError
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetNativeSystemInfo
GetProcessHeap
VirtualQuery
CreateWaitableTimerA
lstrlenW
Process32Next
Process32First
CreateToolhelp32Snapshot
MoveFileA
CreateDirectoryA
GetModuleHandleA
lstrcpyn
GetTempPathA
GetCurrentProcessId
CreateThread
GetModuleHandleW
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
MultiByteToWideChar
RtlUnwind
GetVersion
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
ReleaseMutex
WideCharToMultiByte
user32
MoveWindow
SetActiveWindow
MessageBeep
GetPropA
RemovePropA
PostMessageW
LoadCursorW
LookupIconIdFromDirectoryEx
SetWindowRgn
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
FindWindowExW
GetWindowTextLengthW
GetWindowTextW
GetWindowLongW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowEnabled
EnableWindow
InvalidateRect
GetNextDlgTabItem
SetFocus
GetDC
DrawTextA
ReleaseDC
OffsetRect
GetWindowDC
FillRect
ClientToScreen
MapWindowPoints
SendMessageA
KillTimer
IntersectRect
UpdateLayeredWindow
IsZoomed
IsIconic
LoadCursorFromFileW
PtInRect
SetCaretPos
GetCursorPos
CallWindowProcW
GetFocus
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
GetWindowPlacement
SetWindowLongA
IsDialogMessageA
SetForegroundWindow
GetWindowRect
GrayStringA
TabbedTextOutA
UnhookWindowsHookEx
SetWindowTextA
GetWindow
GetDlgCtrlID
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
PostMessageA
GetActiveWindow
GetForegroundWindow
SetPropA
GetClassLongW
GetSystemMetrics
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
PostQuitMessage
GetClassInfoExW
CreateDialogIndirectParamW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CopyIcon
GetIconInfo
ScreenToClient
ValidateRect
UpdateWindow
SetParent
SetWindowTextW
MessageBoxW
SetPropW
GetPropW
RemovePropW
EnumPropsExW
LoadIconW
SetRect
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
SendMessageTimeoutA
LoadImageW
DrawIconEx
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
LoadStringW
CharUpperW
CharLowerW
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
IsWindow
CallWindowProcA
GetAsyncKeyState
SetTimer
SetWindowPos
GetClassNameW
SystemParametersInfoA
RegisterClassExW
DefWindowProcW
CreateWindowExW
SendDlgItemMessageA
MsgWaitForMultipleObjects
CopyImage
CreateIconFromResourceEx
GetWindowTextLengthA
GetParent
GetWindowThreadProcessId
MessageBoxTimeoutA
CreateWindowStationA
GetClassNameA
GetWindowTextA
IsWindowVisible
GetWindowLongA
SendMessageW
shlwapi
StrToIntExW
wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionA
PathFindFileNameA
PathFileExistsA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
gdi32
GetObjectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
GetDIBits
CreateRectRgn
CreateRoundRectRgn
GetDeviceCaps
CreateDIBSection
CreateCompatibleDC
BitBlt
SetViewportOrgEx
CreateSolidBrush
CreateFontIndirectW
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
CreateBitmap
SaveDC
RestoreDC
GetStockObject
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
CreateEllipticRgn
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
CreatePatternBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
SetMapMode
advapi32
OpenServiceA
CloseServiceHandle
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CreateServiceA
ControlService
shell32
CommandLineToArgvW
ShellExecuteA
Shell_NotifyIconW
DragFinish
SHGetSpecialFolderPathA
DragQueryFileW
DragAcceptFiles
comctl32
InitCommonControlsEx
ord17
ole32
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
StringFromGUID2
CoInitialize
GetHGlobalFromStream
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromProgID
gdiplus
GdipGetImageHeight
GdipGetImageWidth
GdipCloneBitmapArea
GdipGetImagePixelFormat
GdipMeasureString
GdipDeleteFont
GdipResetClip
GdipCreateFontFamilyFromName
GdipCreateFont
GdipGetFontStyle
GdipGetFontSize
GdipGetFamilyName
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipBitmapSetResolution
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipCreateTexture
GdipFillRectangle
GdipDeleteBrush
GdipDisposeImageAttributes
GdipIsStyleAvailable
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreateFromHWND
GdipGetFontHeightGivenDPI
GdipGetFontUnit
GdipGetFamily
GdipGetLogFontA
GdipDeleteGraphics
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectRect
GdipCreateFontFromLogfontW
GdipGetSolidFillColor
GdipSetSolidFillColor
GdipGetBrushType
GdipCloneBrush
GdipGetStringFormatMeasurableCharacterRangeCount
GdipGetStringFormatDigitSubstitution
GdipSetStringFormatDigitSubstitution
GdipGetStringFormatTabStops
GdipGetStringFormatTabStopCount
GdipSetStringFormatTabStops
GdipGetStringFormatHotkeyPrefix
GdipGetStringFormatLineAlign
GdipSetStringFormatLineAlign
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipStringFormatGetGenericDefault
GdipCreateHICONFromBitmap
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageRawFormat
GdipCloneImage
GdipGraphicsClear
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipSetClipHrgn
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImage
GdipDrawDriverString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPie
GdipFillEllipse
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPie
GdipDrawEllipse
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipDeleteStringFormat
GdipSetClipRegion
GdipSetClipRect
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetInterpolationMode
GdipReleaseDC
GdipGetDC
GdipFlush
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateHBITMAPFromBitmap
GdipGetCompositingQuality
GdipCreatePathGradientFromPath
GdipDrawPolygon
GdipFillPolygon
GdipCreatePen2
GdipCreateLineBrush
GdipFillPath
GdipClosePathFigure
GdipAddPathArc
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipCreateRegionHrgn
GdipDeleteRegion
GdipGetRegionBounds
GdipMeasureCharacterRanges
GdipCreateRegion
GdipSetStringFormatMeasurableCharacterRanges
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipLoadImageFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipDisposeImage
GdiplusStartup
GdipDeletePrivateFontCollection
GdipCreateImageAttributes
GdipDrawRectangle
GdipDeletePen
GdipGetLogFontW
GdipSetPenDashStyle
GdipGetStringFormatFlags
GdipGetStringFormatTrimming
GdipGetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDrawString
GdipCreateSolidFill
GdipGetFontHeight
GdipCreateLineBrushFromRect
GdipSetStringFormatHotkeyPrefix
GdipCreateStringFormat
GdipDrawImageRect
GdipBitmapUnlockBits
GdipDeleteFontFamily
GdipLoadImageFromFile
oleaut32
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
OleLoadPicture
imm32
ImmAssociateContext
ImmGetContext
atl
ord42
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
oledlg
ord8
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 800KB - Virtual size: 898KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ