blackmoon | 5b4bd58090eac3b06dde93f7e79f17b0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5b4bd58090eac3b06dde93f7e79f17b0_NeikiAnalytics.exe
Size

1.9MB
MD5

5b4bd58090eac3b06dde93f7e79f17b0
SHA1

9c6daf138875674c5d696b30108925b9afa030bb
SHA256

0d96dea5733c9acbf7b61a2140cef548957ff7f72802d6f58444630c0055dc3c
SHA512

5a77a00ee83fdbb71aff5fd417a6f236a6072652be9c091d57b747511622699bc56a7a78f787dea0035666b6ceb4aab298ebc080ff85bb98d69ddbcbe102e363
SSDEEP

49152:CAX1MOuTP32Orsv+qJPLNL4heKh02deOrLw:j1MVT9G+AJmZh0P

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b4bd58090eac3b06dde93f7e79f17b0_NeikiAnalytics.exe

Files

5b4bd58090eac3b06dde93f7e79f17b0_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

6f3810223391b5683bba3bb1c7d02a2c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMessageTime
GetMessagePos
SystemParametersInfoA
GetWindowPlacement
IsDialogMessageA
GrayStringA
DrawTextA
TabbedTextOutA
UnhookWindowsHookEx
ClientToScreen
GetWindow
GetDlgCtrlID
PtInRect
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
GetNextDlgTabItem
GetKeyState
CallNextHookEx
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
SetActiveWindow
SetWindowRgn
GetForegroundWindow
SetRect
GetClassLongA
SetClassLongA
GetSysColor
EndDialog
DestroyWindow
DestroyIcon
FillRect
IsIconic
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageA
RegisterHotKey
CopyRect
RegisterClassExA
GetClassInfoExA
DialogBoxParamA
CreateDialogParamA
GetDlgItemInt
SetDlgItemInt
GetDlgItemTextA
SetDlgItemTextA
SendDlgItemMessageA
GetDialogBaseUnits
DrawIcon
DrawIconEx
GetIconInfo
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuA
DestroyMenu
AppendMenuA
GetMenuItemCount
InsertMenuA
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringA
GetMenuItemInfoA
GetMenuItemRect
GetMenuState
GetMenuInfo
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
CreateDialogIndirectParamA
PostThreadMessageA
RemovePropA
GetPropA
SetPropA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
SetParent
PostMessageA
SetWindowPos
MoveWindow
UpdateWindow
UnregisterClassA
LoadStringA
GetSysColorBrush
MapWindowPoints
AdjustWindowRectEx
ValidateRect
InvalidateRect
GetClientRect
GetFocus
SetFocus
GetClassNameA
IsWindow
GetDlgItem
GetWindowLongA
CreateWindowExA
DestroyCursor
SetWindowLongA
TrackMouseEvent
SetCursor
LoadCursorA
ScreenToClient
GetWindowRect
GetParent
DefMDIChildProcA
DefWindowProcA
GetAsyncKeyState
CallWindowProcA
SendMessageA
EndPaint
UnregisterHotKey
SetMenuItemInfoA
SetMenuItemBitmaps
SetMenuDefaultItem
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PeekMessageA
BeginPaint
MessageBoxTimeoutA
MessageBoxA
LoadIconA
PostQuitMessage
ReleaseDC
GetDC
CopyIcon
CopyImage
GetActiveWindow
MsgWaitForMultipleObjects

kernel32

VirtualFree
GetVersionExA
GetLastError
GetCurrentProcess
CreateWaitableTimerA
SetWaitableTimer
CloseHandle
GlobalAlloc
GlobalLock
GlobalFree
RtlMoveMemory
GlobalUnlock
MulDiv
CreateThread
MultiByteToWideChar
WideCharToMultiByte
lstrcpyn
GetWindowsDirectoryA
GetTempPathA
GetModuleHandleA
GetProcessHeap
HeapFree
HeapAlloc
LocalSize
ExitProcess
HeapReAlloc
IsBadReadPtr
GetLocalTime
GetTickCount
Sleep
GetModuleFileNameA
WritePrivateProfileStringA
WriteFile
ReadFile
GetFileSize
SetFilePointer
GetPrivateProfileStringA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
LCMapStringW
GlobalDeleteAtom
LocalAlloc
LocalFree
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
lstrcpynA
GlobalFlags
InterlockedDecrement
lstrcatA
lstrcpyA
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
lstrlenA
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
TerminateProcess
RtlUnwind
GetStartupInfoA
GlobalGetAtomNameA
GetVersion
GetOEMCP
GetCPInfo
FlushFileBuffers
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource

advapi32

CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA

shell32

ShellExecuteA
DragQueryFileA
DragFinish
DragAcceptFiles
Shell_NotifyIconA
SHGetSpecialFolderPathA

ole32

CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
CreateStreamOnHGlobal
CLSIDFromString
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
OleInitialize

wininet

InternetOpenA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA

oleaut32

VarR8FromCy
VarR8FromBool
SafeArrayCreate
VariantChangeType
VariantInit
SafeArrayDestroy
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
OleLoadPicture

gdi32

GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetViewportOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateBitmap
SaveDC
CreatePatternBrush
StretchBlt
CreateSolidBrush
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
SelectObject
DeleteDC
CreateDIBSection
CreateCompatibleDC
GetObjectA
GetStockObject
DeleteObject
SetBkColor
BitBlt
SetBkMode
SetTextColor
CreateFontA
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
RestoreDC
SetMapMode

atl

ord42
ord11
ord10
ord47

comctl32

ord17
InitCommonControlsEx

msimg32

AlphaBlend

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

oledlg

ord8

winmm

PlaySoundA

shlwapi

PathFileExistsA

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 800KB - Virtual size: 897KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6f3810223391b5683bba3bb1c7d02a2c

Headers

File Characteristics

Imports

user32

kernel32

advapi32

shell32

ole32

wininet

oleaut32

gdi32

atl

comctl32

msimg32

winspool.drv

oledlg

winmm

shlwapi

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 800KB - Virtual size: 897KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 800KB - Virtual size: 897KB

.rsrc
Size: 20KB - Virtual size: 16KB