blackmoon | 8f7b6c661f7be5e222d2dc656c4a9599eebbe162a8126743c254238fe6cb4365

Sharing

Copy URL Twitter E-mail

General

Target

8f7b6c661f7be5e222d2dc656c4a9599eebbe162a8126743c254238fe6cb4365
Size

1.9MB
MD5

911a4807f9f1da5248eae0ecec3038af
SHA1

083a4a10c02fc59d19973ad4a6574e48981d02ce
SHA256

8f7b6c661f7be5e222d2dc656c4a9599eebbe162a8126743c254238fe6cb4365
SHA512

824039fd7fcaabd8791d26cb9a294b4fd4c39696819050917e3160dab66683f44ac706613a9f4d80f88ba7b765c1f3af339685ece02e7b9dfd7cf28b453f6ee0
SSDEEP

24576:FsA+BZIhR5DZGYYlG4NjHdJ7jjjj3kzjjdd5CIsQ9jBDAtUOWGbonpgWOxzR:F2XlG4NrMd5jDuW3pgWOP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f7b6c661f7be5e222d2dc656c4a9599eebbe162a8126743c254238fe6cb4365

Files

8f7b6c661f7be5e222d2dc656c4a9599eebbe162a8126743c254238fe6cb4365
.exe windows:4 windows x86 arch:x86

417dfe7e509a07c973981afcd1011990

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
FreeLibrary
GetCommandLineA
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
SetStdHandle
IsBadCodePtr
DeleteFileA
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
LCMapStringW
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
VirtualFree
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
FlushFileBuffers
GetCurrentProcess
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
InterlockedIncrement
lstrcpyA
lstrcatA
WritePrivateProfileStringA
InterlockedDecrement
GlobalFlags
TlsGetValue
LocalReAlloc
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualAlloc
GetModuleHandleW
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
SetFilePointer
WriteFile
GetTickCount
CreateFileA
GetFileSize
ReadFile
GetUserDefaultLCID
GetPrivateProfileStringA
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
RtlZeroMemory
lstrcmpiW
lstrcmpW
lstrlenW
GetSystemInfo
GetStringTypeW
LocalSize
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
lstrlenA
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
SetFileTime
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
GetCurrentDirectoryA
CloseHandle
WriteProcessMemory
SystemTimeToFileTime
UnmapViewOfFile
OpenProcess
GlobalSize
CreateThread
lstrcpynA
GetCurrentProcessId
MulDiv
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
RtlMoveMemory
WideCharToMultiByte
GetFileType
MultiByteToWideChar

user32

GetWindowThreadProcessId
EnumWindows
ReleaseDC
GetDC
GetAncestor
SetWindowLongA
PeekMessageA
GetMessageA
DispatchMessageA
wsprintfA
MessageBoxA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuItemInfoW
GetMenuStringW
TrackPopupMenu
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuW
GetMenuItemCount
AppendMenuW
DestroyMenu
LoadMenuW
GetSystemMenu
CreatePopupMenu
CreateMenu
CharLowerW
CharUpperW
DrawTextW
wvsprintfA
RegisterClassExW
SetForegroundWindow
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
FillRect
SetClassLongW
CallWindowProcA
SetRect
SetWindowRgn
DestroyCursor
PostMessageA
SendMessageA
GetWindowLongA
GetLastActivePopup
SetWindowsHookExA
GetCursorPos
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
PostQuitMessage
RegisterClipboardFormatA
MessageBoxW
PtInRect
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
GetWindowTextA
UnhookWindowsHookEx
TabbedTextOutA
DrawTextA
GrayStringA
SendDlgItemMessageA
IsDialogMessageA
GetWindowPlacement
SystemParametersInfoA
RegisterWindowMessageA
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
SetActiveWindow
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
CreateDialogIndirectParamA
EndDialog
GetMenuCheckMarkDimensions
LoadIconW
BeginPaint
EndPaint
CopyIcon
CopyImage
CreateIconFromResource
GetClassNameW
IsWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetParent
GetMessageW
GetClassNameA
CallWindowProcW
GetClassLongW
GetAsyncKeyState
GetClientRect
DestroyWindow
DefWindowProcW
SendMessageW
DefMDIChildProcW
LoadCursorW
SetCursor
TrackMouseEvent
DestroyIcon
SetWindowLongW
CreateWindowExW
GetWindowLongW
GetDlgItem
SetFocus
GetFocus
GetWindowRect
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
MoveWindow
SetWindowPos
PostMessageW
SetParent
IsWindowVisible
ShowWindow
RemovePropW
GetPropW
SetPropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
EnableWindow
IsWindowEnabled

oleaut32

SystemTimeToVariantTime
OleLoadPicture
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantClear
SysAllocString
SafeArrayDestroy
VariantInit
VariantChangeType
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VarR8FromCy
VarR8FromBool

atl

ord42
ord10
ord11
ord47

ole32

OleUninitialize
OleInitialize
OleIsCurrentClipboard
CLSIDFromString
CreateStreamOnHGlobal
OleRun
CoCreateInstance
CoFreeUnusedLibraries
CoRevokeClassObject
CoRegisterMessageFilter
CLSIDFromProgID
OleFlushClipboard

gdi32

FrameRgn
SetBkMode
SetTextColor
FillRgn
CreateCompatibleBitmap
CreatePatternBrush
CreateSolidBrush
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
BitBlt
SelectObject
DeleteDC
CreateDIBSection
GetObjectA
GetStockObject
DeleteObject
CreateDCA
StretchBlt
CreateCompatibleDC
GetDeviceCaps
SetBkColor
CreateBitmap
SaveDC
RestoreDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode

shell32

DragAcceptFiles
SHGetSpecialFolderPathA
ShellExecuteEx
DragQueryFileW
DragFinish
Shell_NotifyIconW

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetGetConnectedState
InternetCloseHandle
InternetOpenUrlA

shlwapi

PathFileExistsA
StrTrimW
PathFindExtensionA
StrToIntExA

psapi

GetProcessMemoryInfo

ws2_32

closesocket

comctl32

InitCommonControlsEx
ord17

dbghelp

MakeSureDirectoryPathExists

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

oledlg

ord8

Sections

.text
Size: 308KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

417dfe7e509a07c973981afcd1011990

Headers

File Characteristics

Imports

kernel32

user32

oleaut32

atl

ole32

gdi32

shell32

wininet

shlwapi

psapi

ws2_32

comctl32

dbghelp

winspool.drv

advapi32

oledlg

Sections

.text Size: 308KB - Virtual size: 305KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 68KB - Virtual size: 67KB

.text
Size: 308KB - Virtual size: 305KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 68KB - Virtual size: 67KB