blackmoon | 8af5dce2c6aaf18896db30474dc74ffc254e0d2369c75c97bbc9caeeb46c5a2f

Sharing

Copy URL Twitter E-mail

General

Target

8af5dce2c6aaf18896db30474dc74ffc254e0d2369c75c97bbc9caeeb46c5a2f
Size

2.4MB
MD5

991b360074c6d22ebf21e6f23f15b20f
SHA1

ff4b402497592f76ca2c20dba45b702873bbda31
SHA256

8af5dce2c6aaf18896db30474dc74ffc254e0d2369c75c97bbc9caeeb46c5a2f
SHA512

53842119bc6990cdf751a1a150f2670586a8db1de29fc85e77483af0ea6b16dfc1c7443e507179b5ae1a9c2ba7f3ba0a44b11537bb730ac89acb2635d1697b77
SSDEEP

24576:oWoNGpTHSZQlW2R2gn//mFtXehQi7pqr7FMrVgIQ2LUWEkBXuzM7k3wJmOKMCmLk:oW1yZt2R2gn/+yXqO6kB+z53wJWqI2N

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8af5dce2c6aaf18896db30474dc74ffc254e0d2369c75c97bbc9caeeb46c5a2f

Files

8af5dce2c6aaf18896db30474dc74ffc254e0d2369c75c97bbc9caeeb46c5a2f
.dll windows:4 windows x86 arch:x86

17bf9bc2bb788d86ac79ac916e059bef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Process32Next
Thread32First
Thread32Next
TerminateThread
CreateWaitableTimerA
SetWaitableTimer
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
DeleteFileA
CreateFileA
GetFileSize
ReadFile
GetCurrentDirectoryA
GetDiskFreeSpaceA
MulDiv
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
QueryDosDeviceA
GetLogicalDriveStringsA
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
VirtualAllocEx
CopyFileA
GetTempPathA
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
OpenThread
CreateThread
CloseHandle
GetVersionExA
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
FlushFileBuffers
SetFilePointer
WriteFile
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
InterlockedIncrement
WritePrivateProfileStringA
GlobalFlags
GetVersion
lstrlenA
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalFree
LocalAlloc
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
IsBadWritePtr
VirtualAlloc
RaiseException
VirtualFree
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
GetNativeSystemInfo
IsBadCodePtr
lstrcpyn
LoadLibraryExA
CloseHandle
WaitForSingleObject
GetProcAddress
GetModuleHandleA
VirtualFreeEx
WriteProcessMemory
GetModuleFileNameA
VirtualAllocEx
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
TerminateProcess
InterlockedIncrement
InterlockedDecrement
RtlUnwind
FlushFileBuffers
LoadLibraryA
GetCommandLineA
FindClose
FindFirstFileA
FreeLibrary
SetStdHandle
FindNextFileA
GetStartupInfoA
LeaveCriticalSection
lstrcpynA
VirtualProtect
CopyFileA
GetTempFileNameA
GetTempPathA
GetSystemDirectoryA
IsWow64Process
OpenProcess
GetCurrentProcess
GetWindowsDirectoryA
CreateWaitableTimerA
SetWaitableTimer
TerminateThread
RtlMoveMemory
CreateToolhelp32Snapshot
Module32First
Module32Next
lstrcpynW
VirtualQuery
Process32First
Process32Next
CreateRemoteThread
GetExitCodeThread
OpenThread
DuplicateHandle
MultiByteToWideChar
HeapCreate
SetCurrentDirectoryA
GetCurrentDirectoryA
GetDiskFreeSpaceExA
GetUserDefaultLCID
WideCharToMultiByte
DeleteFileA
WriteFile
GetTickCount
GetVersionExA
ReadProcessMemory
VirtualQueryEx
CreateProcessA
PeekNamedPipe
lstrlenW
lstrcpyA
InitializeCriticalSection
GetCurrentThreadId
SetProcessAffinityMask
EnterCriticalSection
DeleteCriticalSection
RtlZeroMemory
HeapAlloc
GetVersion
HeapFree
lstrcmpW
CreateFileA
GetFileSize
ReadFile
LCMapStringA
IsBadReadPtr
HeapReAlloc
ExitProcess
GetProcessHeap
lstrcmpiW

shlwapi

PathFindFileNameA
StrToIntExW
PathFileExistsA
PathFindExtensionA
StrToIntExA
PathFindFileNameA
StrToIntW

ws2_32

WSAStartup
WSAStartup
WSACleanup
htons

user32

GetWindowThreadProcessId
GetAncestor
MessageBoxA
EnumWindows
DispatchMessageA
IsWindowVisible
GetMessageA
PeekMessageA
RegisterWindowMessageA
MsgWaitForMultipleObjects
TranslateMessage
GetParent
wsprintfA
DestroyMenu
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
GetSysColor
AdjustWindowRectEx
GetClientRect
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
FindWindowA
ClientToScreen
GetWindowThreadProcessId
GetWindowTextA
GetClassNameA
GetDlgItem
IsWindowVisible
GetMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
CallWindowProcA
GetAncestor
GetParent
EnumWindows
MessageBoxA
SendMessageA
WindowFromPoint
MsgWaitForMultipleObjects
RegisterWindowMessageA
GetForegroundWindow
ShowWindow
GetCursorPos
wsprintfA

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
CryptHashData
AdjustTokenPrivileges
CryptGetHashParam
OpenProcessToken
RegOpenKeyA
RegCloseKey
LookupPrivilegeValueA

psapi

GetMappedFileNameA
GetModuleInformation

gdi32

GetObjectA
CreateBitmap
DeleteObject
DeleteDC
SaveDC
RestoreDC
SelectObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetStockObject

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

SHGetSpecialFolderPathA

ole32

OleRun
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantCopy
SysFreeString
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
SysAllocString
SafeArrayDestroy
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
VariantChangeType
SafeArrayUnaccessData
SafeArrayCreate
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VarR8FromBool
VarR8FromCy
SafeArrayGetElemsize

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

comctl32

ord17

Exports

Exports

GetWindowHandle
_��ӳ��
ngs

Sections

.text
Size: 808KB - Virtual size: 807KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17bf9bc2bb788d86ac79ac916e059bef

Headers

File Characteristics

Imports

kernel32

shlwapi

ws2_32

user32

advapi32

psapi

gdi32

version

shell32

ole32

oleaut32

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 808KB - Virtual size: 807KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 1.5MB - Virtual size: 1.6MB

.rsrc Size: 4KB - Virtual size: 612B

.reloc Size: 36KB - Virtual size: 35KB

.text
Size: 808KB - Virtual size: 807KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 1.5MB - Virtual size: 1.6MB

.rsrc
Size: 4KB - Virtual size: 612B

.reloc
Size: 36KB - Virtual size: 35KB