blackmoon | 9bfd4c79d872aae51983f444fd738a1c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

9bfd4c79d872aae51983f444fd738a1c.exe
Size

2.3MB
MD5

9bfd4c79d872aae51983f444fd738a1c
SHA1

d072d011b74d723f22d5ea052d5df4d9812f288f
SHA256

3c100370639ef340137dd7b23946541aba2fed6a9d75ed73f440204832a12011
SHA512

1c0f32035c1683549fbccd4c836ec6ccbe184e54e22b1c92ba4b7bbab7197ddc0848239d0ef58cea4245bdb8d7120e0fced514cbb8008239d22502544cf85805
SSDEEP

49152:RSASC4N4moMb9V7uNRXNx7OX2YgQUgZgfZRfmyyZkDWdmubUOK:gAsNX1H4R9xGgQbslmyyZt

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bfd4c79d872aae51983f444fd738a1c.exe

Files

9bfd4c79d872aae51983f444fd738a1c.exe
.exe windows:4 windows x86 arch:x86

44ebc61662b957e0828ad8f78246fcbe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetUserDefaultLCID
GetLocalTime
IsBadReadPtr
LoadLibraryA
LCMapStringA
HeapReAlloc
ExitProcess
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleHandleA
GlobalFree
HeapAlloc
HeapFree
GetProcessHeap
LocalSize
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
lstrcpyn
WideCharToMultiByte
MultiByteToWideChar
RtlMoveMemory
VirtualProtect
GetProcAddress
FreeLibrary

gdiplus

GdipSetClipHrgn
GdipCreateFromHDC
GdiplusStartup
GdipDrawImageRectRect
GdipCreatePath
GdipAddPathRectangle
GdipSetSmoothingMode
GdipClosePathFigure
GdipSetCompositingQuality
GdipCreatePen1
GdipGetImageDimension
GdipDrawPath
GdipDeletePath
GdipDeletePen
GdipResetClip
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipGetImageHeight
GdipAddPathArc

wininet

InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetOpenA

user32

ValidateRect
UpdateWindow
MoveWindow
SetWindowPos
PostMessageA
SetParent
IsWindowVisible
ShowWindow
IsWindowEnabled
EnableWindow
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
MessageBoxA
RemovePropA
SetWindowRgn
SetRect
GetClassLongA
SetClassLongA
FillRect
UpdateLayeredWindow
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageA
RegisterHotKey
UnregisterHotKey
SetActiveWindow
RegisterClassExA
CreateMenu
CreatePopupMenu
GetWindowLongA
LoadMenuA
DestroyMenu
AppendMenuA
GetMenuItemCount
InsertMenuA
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
InvalidateRect
TrackPopupMenu
GetMenuStringA
GetMenuItemInfoA
GetMenuItemRect
GetMenuState
GetMenuInfo
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoA
SetMenuItemBitmaps
SetMenuDefaultItem
wsprintfA
PeekMessageA
GetDC
GetWindowRect
GetClassInfoExA
SetPropA
GetPropA
MsgWaitForMultipleObjects
PostQuitMessage
LoadIconA
CreateWindowExA
DestroyCursor
SetWindowLongA
DestroyIcon
TrackMouseEvent
SetCursor
LoadCursorA
DefMDIChildProcA
SendMessageA
DefWindowProcA
DestroyWindow
GetClientRect
GetAsyncKeyState
CallWindowProcA
EndPaint
BeginPaint
GetClassNameA
IsWindow
DispatchMessageA
TranslateMessage
IsDialogMessageA
ScreenToClient
GetFocus
SetFocus
SetForegroundWindow
GetDlgItem
TranslateAcceleratorA
GetParent
GetMessageA
GetSystemMenu
ReleaseDC
GetSysColor

gdi32

CreateCompatibleDC
SetBkMode
SetBkColor
SetTextColor
CreatePatternBrush
CreateSolidBrush
StretchBlt
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
BitBlt
CreateDIBSection
GetObjectA
GetStockObject
DeleteDC
DeleteObject
SelectObject

atl

ord47
ord42

ole32

CoInitialize
CoUninitialize
CreateStreamOnHGlobal
OleRun
CLSIDFromProgID
CoCreateInstance
CLSIDFromString

shell32

Shell_NotifyIconA
DragFinish
DragQueryFileA
DragAcceptFiles

msvcrt

sprintf
toupper
_CIfmod
strncmp
??3@YAXPAX@Z
tolower
atoi
_ftol
strncpy
??2@YAPAXI@Z
strchr
memmove
free
malloc
__CxxFrameHandler
modf
_strnicmp

oleaut32

SafeArrayDestroy
SysAllocString
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VarR8FromBool
VarR8FromCy
SysFreeString
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
VariantClear

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

44ebc61662b957e0828ad8f78246fcbe

Headers

File Characteristics

Imports

kernel32

gdiplus

wininet

user32

gdi32

atl

ole32

shell32

msvcrt

oleaut32

Sections

.text Size: 177KB - Virtual size: 177KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 2.1MB - Virtual size: 2.1MB

.text
Size: 177KB - Virtual size: 177KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 2.1MB - Virtual size: 2.1MB