Behavioral task
behavioral1
Sample
e5805deb672c88d7d833e322ae9f813b266dbbe92e1f35d405e7bf5aca583ca1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e5805deb672c88d7d833e322ae9f813b266dbbe92e1f35d405e7bf5aca583ca1.exe
Resource
win10v2004-20240426-en
General
-
Target
e5805deb672c88d7d833e322ae9f813b266dbbe92e1f35d405e7bf5aca583ca1
-
Size
3.3MB
-
MD5
53747912d7d26cdc7e120299a8776523
-
SHA1
401f823c85d6bfa5a152f04d80a6e70955a81bb9
-
SHA256
e5805deb672c88d7d833e322ae9f813b266dbbe92e1f35d405e7bf5aca583ca1
-
SHA512
2284a5a662a8bdcec8b9b53e959d1cb9202585e2deede714499101cbfd55212f36bcacec133cbe2a1d21ce496e4c804d1d3bfdfcd21161a4d352e97189ebf1b3
-
SSDEEP
49152:ijlA0Ck5pPHWjZTNM79JjvKWQyDSbi8GyuhzEYLXCGLcvhohZ:rqaZm7/jtQyDSbPooc3Lcvhoj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e5805deb672c88d7d833e322ae9f813b266dbbe92e1f35d405e7bf5aca583ca1
Files
-
e5805deb672c88d7d833e322ae9f813b266dbbe92e1f35d405e7bf5aca583ca1.exe windows:4 windows x86 arch:x86
e28a497c0e65e0a3c02235cbea4f39b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
LoadLibraryA
FreeLibrary
GetCommandLineA
GlobalFree
GetUserDefaultLCID
WritePrivateProfileStringA
CopyFileA
GetPrivateProfileStringA
GetCurrentDirectoryA
GetDiskFreeSpaceExA
GetStartupInfoA
WaitForSingleObject
MoveFileA
GetTickCount
RemoveDirectoryA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
SetFilePointer
GetLocalTime
InterlockedDecrement
InterlockedIncrement
LocalSize
CreateProcessA
IsBadCodePtr
lstrcpyn
TerminateProcess
CloseHandle
CreateToolhelp32Snapshot
WideCharToMultiByte
RtlMoveMemory
MultiByteToWideChar
lstrcatW
HeapFree
HeapAlloc
GetProcessHeap
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
FlushFileBuffers
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
SetLastError
lstrcpyA
lstrcatA
GlobalFlags
CreateDirectoryA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
CreateFileA
WriteFile
IsBadReadPtr
HeapReAlloc
ExitProcess
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
RtlZeroMemory
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
lstrcmpiW
lstrcmpA
MulDiv
lstrcpynA
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
LocalFree
LocalAlloc
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
GetCurrentProcess
GetLastError
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
lstrlenW
CreateThread
GetProcAddress
lstrlenA
GetModuleHandleA
user32
CopyIcon
GetIconInfo
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetParent
SetWindowTextW
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
SetWindowLongA
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
TabbedTextOutA
UnhookWindowsHookEx
GetWindowTextA
PostMessageW
GetWindow
GetDlgCtrlID
GetParent
GetClassNameA
GetClassNameW
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetKeyState
CallNextHookEx
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SendMessageA
PostMessageA
SetActiveWindow
GetActiveWindow
GetForegroundWindow
MessageBoxW
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
UpdateLayeredWindow
CreateIconFromResourceEx
LoadImageW
DrawIconEx
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
LoadStringW
CharUpperW
CharLowerW
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
ShowWindow
CallWindowProcW
CreateMDIWindowW
DialogBoxParamW
CreateDialogParamW
EndDialog
BeginPaint
SetWindowRgn
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
GetAsyncKeyState
SetWindowTextA
FindWindowExW
CallWindowProcA
KillTimer
GetWindowLongW
SendMessageW
SetTimer
IsWindow
DestroyCursor
SetCursor
GetClientRect
SetCapture
GetWindowTextLengthW
RegisterClipboardFormatA
GetWindowTextW
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowVisible
IsWindowEnabled
DialogBoxIndirectParamW
DestroyWindow
SetClassLongW
GetClassLongW
CreateDialogIndirectParamW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
TranslateMDISysAccel
IsChild
GetMessageW
GetFocus
ClientToScreen
FillRect
GetWindowDC
EnableWindow
DefWindowProcW
OffsetRect
ReleaseDC
DrawTextA
GetDC
SetFocus
GetNextDlgTabItem
GetWindowRect
SetWindowPos
PtInRect
shell32
DragFinish
Shell_NotifyIconW
CommandLineToArgvW
DragAcceptFiles
SHGetSpecialFolderPathA
DragQueryFileW
ole32
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
StringFromGUID2
GetHGlobalFromStream
CLSIDFromString
OleRun
CoCreateInstance
CLSIDFromProgID
gdi32
CreateBitmap
GetObjectA
GetDIBits
CreatePatternBrush
CreateEllipticRgn
CreateFontIndirectW
GetObjectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateRoundRectRgn
CreateSolidBrush
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
SaveDC
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
comctl32
InitCommonControlsEx
ord17
wininet
InternetOpenUrlA
HttpQueryInfoA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
gdiplus
GdipCreateTexture
GdipDeleteBrush
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDisposeImage
GdiplusStartup
GdipDeleteFont
GdipDeletePath
GdipDeleteRegion
GdipCreateImageAttributes
GdipCloneImageAttributes
GdipSetImageAttributesToIdentity
GdipResetImageAttributes
GdipSetImageAttributesThreshold
GdipFillRectangle
GdipSetImageAttributesNoOp
GdipSetImageAttributesGamma
GdipSetImageAttributesColorKeys
GdipSetImageAttributesOutputChannel
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipPrivateAddMemoryFont
GdipPrivateAddFontFile
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipRotateMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipSetImageAttributesOutputChannelColorProfile
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArcI
GdipAddPathLineI
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipIsVisiblePathPoint
atl
ord42
shlwapi
PathFindFileNameW
StrTrimW
StrToIntW
wvnsprintfW
StrToIntExW
PathRemoveFileSpecW
PathFileExistsA
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
oledlg
ord8
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
Sections
.text Size: 716KB - Virtual size: 714KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.5MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE