blackmoon | 533b66f78c81b9c06be8722a6b0d5bf19214a01668b44f3073a667d047d967cb

Sharing

Copy URL Twitter E-mail

General

Target

533b66f78c81b9c06be8722a6b0d5bf19214a01668b44f3073a667d047d967cb
Size

892KB
MD5

1ffa434892f6d5308bc740c97b1fbce8
SHA1

7262a264a914b3ee3d80399cfd41f9e3d4097475
SHA256

533b66f78c81b9c06be8722a6b0d5bf19214a01668b44f3073a667d047d967cb
SHA512

e926d4552429d0dd0fed0526aea73f975b19c6fc91ca368c75568c26f35cdf3fcea2b7d3c0e6fe85923cd15df62a5ee9f1fa87e553dd9a222ed22dda6f19d603
SSDEEP

24576:MgeBf3AuqO8p5ebjaXp/RRLRbGKLbjA/uug:MuudG5Q2XHK/

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
533b66f78c81b9c06be8722a6b0d5bf19214a01668b44f3073a667d047d967cb

Files

533b66f78c81b9c06be8722a6b0d5bf19214a01668b44f3073a667d047d967cb
.dll windows:4 windows x86 arch:x86

d64947ff1a05d382ab54c9fb07ff7864

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
InterlockedIncrement
InterlockedDecrement
LocalFree
FlushFileBuffers
lstrcpynA
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
GlobalFlags
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetVersion
GetCommandLineA
GetTickCount
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetStartupInfoA
CreateProcessA
WaitForSingleObject
SetFileAttributesA
CreateFileA
WriteFile
lstrcatA
SetLastError
MultiByteToWideChar
lstrlenA
GetSystemDirectoryA
lstrcpyA
GetWindowsDirectoryA
GetModuleHandleA
GetTempPathA
TerminateProcess
GetVersionExA
GetCurrentProcess
SetFilePointer
GlobalFree
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CloseHandle
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
DeviceIoControl
GetLastError
GetLocalTime

shlwapi

PathFindFileNameA

user32

SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
GetSysColorBrush
LoadStringA
DestroyMenu
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
SetCursor
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
EnableWindow
GetParent
GetWindow
PtInRect
IsWindowVisible
GetWindowLongA
GetWindowTextA
FindWindowExA
GetCursorPos
SetWindowLongA
GetDlgItem
ShowWindow
SystemParametersInfoA
ReleaseDC
GetClassNameA
SendMessageA
GetWindowRect
GetMenuItemCount
SetWindowTextA
GetDlgCtrlID
UnregisterClassA
DestroyWindow
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
LoadCursorA
ModifyMenuA
GetWindowThreadProcessId
MessageBoxA
wsprintfA
CloseClipboard
SetClipboardData
GetSystemMetrics
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
OpenClipboard
GetDC
EmptyClipboard

gdi32

DeleteDC
SelectObject
GetObjectA
GetStockObject
GetDeviceCaps
Escape
DeleteObject
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateBitmap
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox

advapi32

RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
CreateServiceA
StartServiceA
ControlService
CloseServiceHandle
OpenServiceA
OpenSCManagerA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

comctl32

ord17

Exports

Exports

CPlApplet

Sections

.text
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 688KB - Virtual size: 835KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d64947ff1a05d382ab54c9fb07ff7864

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

gdi32

advapi32

winspool.drv

shell32

comctl32

Exports

Exports

Sections

.text Size: 148KB - Virtual size: 146KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 688KB - Virtual size: 835KB

.reloc Size: 32KB - Virtual size: 28KB

.text
Size: 148KB - Virtual size: 146KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 688KB - Virtual size: 835KB

.reloc
Size: 32KB - Virtual size: 28KB