blackmoon | d6e04e98a1b8de8302d7aa0edee48ae7c3a95aa4c149bdc374d1df3f68c03c06

Sharing

Copy URL Twitter E-mail

General

Target

d6e04e98a1b8de8302d7aa0edee48ae7c3a95aa4c149bdc374d1df3f68c03c06
Size

1.0MB
MD5

08adddc05927f8b0080f3db76b493ffc
SHA1

c5eddedd38dbd1eaa215e7061ac370e6405594a2
SHA256

d6e04e98a1b8de8302d7aa0edee48ae7c3a95aa4c149bdc374d1df3f68c03c06
SHA512

e600a44f2c536b6bce34d27c99d4d1556d1c08b4f1aa3e67151aba7b78e30284d8a5988b3b5cefc30bdef392d72395e029af0eca71871522083e42ff61d7459b
SSDEEP

24576:Mzw+HUgIpm7X6vMcTUrrjYgoFlpxGfzbmfkUJGFbJmyXUZI4pCO9h92dsNcdoLiT:MnIpm7X6vMcTU/jYgoGfzbmfkUJ6Q4qu

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6e04e98a1b8de8302d7aa0edee48ae7c3a95aa4c149bdc374d1df3f68c03c06

Files

d6e04e98a1b8de8302d7aa0edee48ae7c3a95aa4c149bdc374d1df3f68c03c06
.dll windows:4 windows x86 arch:x86

c42f6099c77f593fb5e877dcf96b9fa6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LCMapStringA
GetCommandLineA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetEnvironmentVariableA
GetModuleFileNameA
CopyFileA
CreateDirectoryA
MoveFileA
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
SetFilePointer
GetFileSize
GetTickCount
SetFileAttributesA
WritePrivateProfileStringA
GetLocalTime
GetPrivateProfileStringA
GetCurrentDirectoryA
GetDiskFreeSpaceA
MulDiv
GetUserDefaultLCID
GetStartupInfoA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
lstrcmpW
lstrcmpiA
HeapDestroy
HeapCreate
GetAtomNameW
GlobalUnlock
GetVersionExA
GlobalLock
GlobalAlloc
FreeLibrary
SetEvent
WaitForSingleObject
WriteProcessMemory
ReadProcessMemory
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenW
lstrlenA
GetCurrentProcess
HeapFree
InterlockedDecrement
InterlockedIncrement
LocalSize
HeapAlloc
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
LCMapStringW
IsBadWritePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
FlushFileBuffers
GetProcessVersion
FindResourceA
LoadResource
LockResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
SetLastError
GlobalFlags
lstrcpyA
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GlobalDeleteAtom
GetCurrentThread
GetVersion
CreateEventA
Module32Next
SetProcessWorkingSetSize
GlobalFree
GlobalSize
LoadLibraryA
VirtualAlloc
GetCurrentThreadId
Sleep
ProcessIdToSessionId
GetProcessHeap
_lclose
GetTimeFormatA
GetDateFormatA
LocalFree
LocalAlloc
Module32First
IsWow64Process
WriteFile
TerminateProcess
RtlZeroMemory
WTSGetActiveConsoleSessionId
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetDriveTypeA
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
VirtualFree
GetLastError
RtlMoveMemory
GetQueuedCompletionStatus
CreateThread
GetSystemInfo
CreateIoCompletionPort
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetSystemPowerState
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
WideCharToMultiByte
MultiByteToWideChar
GlobalMemoryStatusEx
SetWaitableTimer
CreateWaitableTimerA
lstrcpyn
GetProcAddress
GetModuleHandleA
CreateFileA
GetCurrentProcessId
lstrcpynA
CloseHandle
VirtualQueryEx

user32

GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetParent
GetWindowLongW
SendMessageW
SetWindowLongW
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
MsgWaitForMultipleObjects
CallNextHookEx
GetSystemMetrics
GetAncestor
GetDlgItem
TrackMouseEvent
EndPaint
BeginPaint
SetProcessWindowStation
DispatchMessageA
DestroyCursor
OpenWindowStationA
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
PeekMessageA
BlockInput
MessageBoxA
CharLowerW
CharUpperW
LoadStringW
SetMenuDefaultItem
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
DestroyAcceleratorTable
GetSysColor
IsWindowEnabled
EnableWindow
SetWindowPos
GetNextDlgTabItem
SetFocus
CallWindowProcW
GetIconInfo
GetDesktopWindow
GetCursorInfo
DrawIcon
GetThreadDesktop
SetThreadDesktop
CloseDesktop
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
GetMessageA
SetLayeredWindowAttributes
GetWindowLongA
SetWindowLongA
GetWindowThreadProcessId
GetClassNameA
IsWindowVisible
EnumWindows
MoveWindow
SetForegroundWindow
CloseWindow
ReleaseDC
CopyImage
GetDC
GetWindowRect
FindWindowA
ShowWindow
SetCursorPos
ClientToScreen
mouse_event
UnhookWindowsHookEx
LockWorkStation
keybd_event
PostMessageA
SetWindowsHookExA
wsprintfA
TranslateMessage
CreateMDIWindowW
DefWindowProcW
CreateDialogIndirectParamA
GetWindowTextA
PostThreadMessageA
LoadStringA
LoadCursorA
LoadIconA
MapWindowPoints
AdjustWindowRectEx
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
IsDialogMessageA
SendDlgItemMessageA
GrayStringA
TabbedTextOutA
SetWindowTextA
GetWindow
GetDlgCtrlID
PtInRect
UnregisterClassA
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetKeyState
GetCursorPos
GetLastActivePopup
FillRect
DrawFocusRect
OffsetRect
CopyRect
FrameRect
InflateRect
GetSysColorBrush
GetWindowDC
CallWindowProcA
DefWindowProcA
EnumChildWindows
SendMessageA
RedrawWindow
GetWindowTextLengthA
EnumThreadWindows
DrawTextA
ExitWindowsEx
SetActiveWindow
GetActiveWindow
GetForegroundWindow
PostMessageW
CopyIcon
GetFocus
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
SetParent
SetWindowTextW
MessageBoxW
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetWindowRgn
SetRect
IsIconic
IsZoomed
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
SystemParametersInfoW
GetMessageW
TranslateAcceleratorW
DispatchMessageW
IsChild
TranslateMDISysAccel
IsDialogMessageW
PostQuitMessage
CreateIconFromResourceEx
LoadImageW
DrawIconEx
UpdateLayeredWindow
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
OpenInputDesktop

advapi32

StartServiceA
CreateServiceA
CloseServiceHandle
RegCreateKeyA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
EnumDependentServicesA
EnumServicesStatusExA
EnumServicesStatusA
ChangeServiceConfigA
ControlService
OpenSCManagerA
DeleteService
GetServiceKeyNameA
GetServiceDisplayNameA
ChangeServiceConfig2A
QueryServiceConfig2A
QueryServiceConfigA
QueryServiceStatus
OpenServiceA
StartServiceCtrlDispatcherA
RegEnumValueA
RegEnumKeyA
RegOpenKeyA
LookupAccountSidA
CreateProcessAsUserA
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx

shell32

SHGetSpecialFolderPathA
ShellExecuteA
DragQueryFileW
CommandLineToArgvW
DragAcceptFiles
Shell_NotifyIconW
DragFinish

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CLSIDFromProgID
CreateStreamOnHGlobal
GetHGlobalFromStream
CLSIDFromString
OleRun
CoCreateInstance
StringFromGUID2

winmm

waveInGetDevCapsA
waveInStop
waveInUnprepareHeader
waveInGetNumDevs
waveInStart
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInClose

ws2_32

WSAStartup
closesocket
WSARecv
WSASend
WSASocketA
inet_addr
htons
connect
getsockname
sendto
recvfrom
htonl
ntohs
getpeername
send
recv
select
__WSAFDIsSet
accept
socket
bind
listen
gethostbyname
WSACleanup
inet_ntoa
gethostname

gdi32

SetBkMode
SetTextColor
GetDIBits
GetObjectA
DeleteObject
DeleteDC
GetTextExtentPoint32A
GetTextColor
SetPixel
LineTo
MoveToEx
SelectClipRgn
CreateEllipticRgnIndirect
Arc
Ellipse
BitBlt
CreateBitmap
SaveDC
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
PtVisible
RectVisible
SelectObject
CreateCompatibleBitmap
CreatePatternBrush
CreateFontIndirectW
StretchBlt
SetStretchBltMode
GetStretchBltMode
GetObjectW
CreateSolidBrush
GetStockObject
CreateRoundRectRgn
GdiFlush
CreateDIBSection
GetDeviceCaps
GetTextMetricsA
SetBkColor
GetPixel
CreatePen
Escape
ExtTextOutA
TextOutA
CreateCompatibleDC

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

msimg32

GradientFill
AlphaBlend

wininet

HttpQueryInfoA
InternetReadFile
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetGetConnectedState

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

oleaut32

VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SysFreeString
VariantInit
SafeArrayGetElemsize
SafeArrayAllocDescriptor
SafeArrayUnaccessData
VariantTimeToSystemTime

shlwapi

StrToIntExW
wvnsprintfW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntW
StrTrimW
PathIsDirectoryA
StrFormatByteSize64A
PathFileExistsA

winhttp

WinHttpSetOption
WinHttpCloseHandle
WinHttpSetCredentials
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpOpen
WinHttpCrackUrl
WinHttpCheckPlatform
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpOpenRequest

gdiplus

GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathRectangle
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetFontHeightGivenDPI
GdipGetFontHeight
GdipGetFontUnit
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipGetLogFontA
GdipGetLogFontW
GdipCloneFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFontFamily
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontW
GdipCreateFont
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipCreateBitmapFromResource
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipGetRegionScansCount
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipCloneBitmapArea
GdipBitmapSetResolution
GdipCreateSolidFill
GdipCreateMatrix
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipGetImageAttributesAdjustedPalette
GdipSetImageAttributesWrapMode
GdipSetImageAttributesRemapTable
GdipSetImageAttributesOutputChannelColorProfile
GdipSetImageAttributesOutputChannel
GdipTranslateMatrix
GdipRotateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCloneMatrix
GdipSetMatrixElements
GdipGetMatrixElements
GdipMultiplyMatrix
GdipInvertMatrix
GdipScaleMatrix
GdipShearMatrix
GdipTransformMatrixPoints
GdipVectorTransformMatrixPoints
GdipIsMatrixInvertible
GdipIsMatrixIdentity
GdipIsMatrixEqual
GdipSetImageAttributesColorKeys
GdipSetImageAttributesGamma
GdipSetImageAttributesNoOp
GdipSetImageAttributesThreshold
GdipResetImageAttributes
GdipSetImageAttributesToIdentity
GdipCloneImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipDeleteRegion
GdipDeletePath
GdipDeleteFont
GdipDeleteGraphics
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFillRectangle
GdipCreateTexture
GdiplusShutdown
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusStartup
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddMemoryFont
GdipGetFontCollectionFamilyCount
GdipGetRegionScans
GdipCreateBitmapFromFile
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipTransformPointsI
GdipDrawImageRect
GdipCreateBitmapFromHICON
GdipGetLineSpacing
GdipGetCellDescent
GdipGetCellAscent
GdipGetEmHeight
GdipIsStyleAvailable
GdipGetFamilyName
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySerif
GdipIsVisibleRect
GdipGetGenericFontFamilySansSerif
GdipPrivateAddFontFile

dbghelp

MakeSureDirectoryPathExists

crypt32

CryptStringToBinaryW

atl

ord42

oledlg

ord8

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

Exports

Exports

CallKeyHookProc
ServiceMain
init

Sections

.text
Size: 848KB - Virtual size: 845KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c42f6099c77f593fb5e877dcf96b9fa6

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

winmm

ws2_32

gdi32

comctl32

msimg32

wininet

psapi

wtsapi32

userenv

version

oleaut32

shlwapi

winhttp

gdiplus

dbghelp

crypt32

atl

oledlg

winspool.drv

Exports

Exports

Sections

.text Size: 848KB - Virtual size: 845KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 100KB - Virtual size: 199KB

.rsrc Size: 4KB - Virtual size: 756B

.reloc Size: 44KB - Virtual size: 41KB

.text
Size: 848KB - Virtual size: 845KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 100KB - Virtual size: 199KB

.rsrc
Size: 4KB - Virtual size: 756B

.reloc
Size: 44KB - Virtual size: 41KB