blackmoon | 47f48076e64635a23b55f4f4c3f750cd_JaffaCakes118

General

Target

47f48076e64635a23b55f4f4c3f750cd_JaffaCakes118
Size

119KB
MD5

47f48076e64635a23b55f4f4c3f750cd
SHA1

cce4fd707dcf0b88f331398f9ecaea0f6787bbaa
SHA256

397e3645a6712d4dfa2539fbdc3be0db627274197d342453941d311499dd102c
SHA512

0daf052b66343210e2b2a30dc52f5124da206f0da6e71155294e368e2115c512c6a262e6e79e4fd08b6065a4d198789c0a243db50a5a96cc1200449eac328073
SSDEEP

3072:zh/LxCThtQR2BqCS61CopkpglOBtyGNIlXR/J2:zd+htBqf6wvWlOBtyGse

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
static1/unpack001/酷我/酷我.exe	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/酷我/酷我.exe

Files

47f48076e64635a23b55f4f4c3f750cd_JaffaCakes118
.zip
酷我/使用说明.docx
.docx office2007
酷我/酷我.exe
.exe windows:4 windows x86 arch:x86

fe361d01e72aff95af8e5346400888c6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
LoadResource
LockResource
CreateProcessA
lstrcpyn
RtlMoveMemory
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
OpenProcess
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
lstrcatA
GetCurrentThreadId
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
FindResourceA
GetModuleFileNameA
CreateDirectoryA
WriteFile
CreateFileA
GetFileSize
DeleteFileA
SetFileAttributesA
Sleep
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetModuleHandleA
TerminateThread
DeleteCriticalSection
CreateThread
CreateEventA
IsBadReadPtr
OpenEventA

user32

GetSystemMetrics
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
GetFocus
SetFocus
AttachThreadInput
MoveWindow
EnableWindow
IsWindowEnabled
CallWindowProcA
CopyImage
ShowWindow
EnumChildWindows
IsWindowVisible
GetWindowThreadProcessId
MessageBoxTimeoutA
PeekMessageA

shlwapi

PathFileExistsA
PathIsDirectoryA
PathRemoveExtensionA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

gdi32

DeleteObject

msvcrt

calloc
__CxxFrameHandler
malloc
free
_strnicmp
sprintf
??3@YAXPAX@Z
atoi
_ftol
strncpy
strncmp
floor
_CIfmod
tolower
_CIpow
strrchr
strchr
modf
memmove

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fe361d01e72aff95af8e5346400888c6

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

shell32

gdi32

msvcrt

Sections

.text Size: 86KB - Virtual size: 85KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 41KB - Virtual size: 102KB

.rsrc Size: 85KB - Virtual size: 85KB

.text
Size: 86KB - Virtual size: 85KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 41KB - Virtual size: 102KB

.rsrc
Size: 85KB - Virtual size: 85KB