blackmoon | 975508715529d1596ac34b51f49e2d4f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
975508715529d1596ac34b51f49e2d4f_JaffaCakes118
Size 1.1MB
Sample240605-gn9qmagg35
SHA256 90999d410d1600ac34b2e471f83a6ba98837fa64400bde294bac3e456bdebcc6
MD5 975508715529d1596ac34b51f49e2d4f
SHA1 4137733517f1f8aa4b33b8282f7f5622701fe2c7
SHA512 5d8acd9e6a83954ba3070354763480266d10ab5dca8e54c1594e5b81bb28e8ed1c55bfeeb275fd0ba6dd824cad8b71e2342ba2d34e7af3763754349b3d538b97
SSDEEP 24576:yFx86hEXZBs9SnU0cklbuddQeuBJ/ynn3fLc8uh/q/Nq:bKEJq8nxZudfK8nw8u5b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
static1/unpack001/zjqqfc2016yjscs_gr/紫界QQ飞车一键刷商城辅助.exe	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/zjqqfc2016yjscs_gr/紫界QQ飞车一键刷商城辅助.exe

File Explorer

975508715529d1596ac34b51f49e2d4f_JaffaCakes118

.zip 1.1MB
zjqqfc2016yjscs_gr/更多软件下载.url

219B
zjqqfc2016yjscs_gr/紫界QQ飞车一键刷商城辅助.exe

.exe 2.1MB
zjqqfc2016yjscs_gr/软件下载说明.txt

1KB

975508715529d1596ac34b51f49e2d4f_JaffaCakes118

SHA256 90999d410d1600ac34b2e471f83a6ba98837fa64400bde294bac3e456bdebcc6
MD5 975508715529d1596ac34b51f49e2d4f
SHA1 4137733517f1f8aa4b33b8282f7f5622701fe2c7
SHA512 5d8acd9e6a83954ba3070354763480266d10ab5dca8e54c1594e5b81bb28e8ed1c55bfeeb275fd0ba6dd824cad8b71e2342ba2d34e7af3763754349b3d538b97
SSDEEP 24576:yFx86hEXZBs9SnU0cklbuddQeuBJ/ynn3fLc8uh/q/Nq:bKEJq8nxZudfK8nw8u5b
MD5 SHA1 SHA512 SSDEEP

zjqqfc2016yjscs_gr/紫界QQ飞车一键刷商城辅助.exe

IMPHASH 59d22d83bc445b7b53f5d9b33379a937
SHA256 8666bd15a90ac31abbd78d52e5a01e472effccca6e2f14573a043db2d22ac6e5
MD5 d3c42932d193bc09ad1ef1811c1f1024
SHA1 f94ba47ea46ad0d7a825b02d8fe14d53a59485da
SHA512 265746f96a566d33ed908f2c1d7495e78504d5921617ef3d52ee91d5616cfe34e9e5e4b11dfcb6721fdbb4db862020b5050269cbd9b6de8e4b97dbc7518c3d5c
SSDEEP 49152:VI5Zpx2Or8dXuwoWezjBqXbLUyeaXuwoWezjBsUHR:q5fx2Or8MMecXbeMeae
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Blackmoon payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2265088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer GetCurrentProcess DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree MultiByteToWideChar WideCharToMultiByte InterlockedDecrement CreateSemaphoreA ResumeThread ReleaseSemaphore SetStdHandle IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose GetFileAttributesA TerminateProcess GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedIncrement

user32

OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent GetClipboardData PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow CloseClipboard wsprintfA EqualRect GetWindowRect SetForegroundWindow WaitForInputIdle IsWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetWindowLongA RedrawWindow EnableWindow IsWindowVisible OffsetRect PtInRect DestroyIcon IntersectRect InflateRect SetRect SetScrollPos SetScrollRange GetScrollRange SetCapture GetCapture ReleaseCapture LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetForegroundWindow GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos UnregisterClassA AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer

gdi32

GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt SetStretchBltMode CreateRectRgn FillRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo CreateRectRgnIndirect SetBkColor CombineRgn GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA

shell32

ShellExecuteA Shell_NotifyIconA

ole32

OleUninitialize CLSIDFromString OleInitialize

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

ioctlsocket recv getpeername accept recvfrom WSAAsyncSelect closesocket WSACleanup inet_ntoa

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA