blackmoon | 92f4c5be228300dd8b60b12074faf360_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

92f4c5be228300dd8b60b12074faf360_NeikiAnalytics.exe
Size

1.3MB
MD5

92f4c5be228300dd8b60b12074faf360
SHA1

c72c5ed2742c9d238ba8513c744c563d00feb29f
SHA256

497cb25e466c1525d91fc921bfe1cec91d73534c9c869596099b03aaa5843a9a
SHA512

ddcd9fd36f3adaddcdcd6168237546a6a75efe199feaa28813056d8dc2a76495a33b6d43b4ab1e548986384013421c163e48ac5a5da3137171ebf8b28eebae3a
SSDEEP

24576:0IBuSqeNcfy2vPDN33aef14D9VCo24aCiJeLEhdsT7GfwchrVAQrSZNAbXePo/Zm:0vDN33aefZ3fwIumDeqZ5s

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
92f4c5be228300dd8b60b12074faf360_NeikiAnalytics.exe

Files

92f4c5be228300dd8b60b12074faf360_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

5b38aac1b845f6cf7b6c3897d06fc7e6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
LCMapStringW
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
HeapSize
GetACP
ExitThread
RaiseException
GetSystemTime
RtlUnwind
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
GlobalUnlock
RtlMoveMemory
GlobalFree
GlobalLock
GlobalAlloc
SetWaitableTimer
CreateWaitableTimerA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
TerminateProcess
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
MulDiv
lstrcpyn
SetProcessWorkingSetSize
TerminateThread
GetModuleHandleA
lstrcpynA
VirtualAlloc
LoadLibraryA
GetProcAddress
VirtualFree
GetProcessHeap
HeapFree
HeapAlloc
LocalSize
WideCharToMultiByte
lstrlenA
ExitProcess
HeapReAlloc
IsBadReadPtr
GetModuleFileNameA
CloseHandle
ReadFile
GetFileSize
CreateFileA
CreateDirectoryA
WritePrivateProfileStringA
GetUserDefaultLCID
LCMapStringA
FreeLibrary
RemoveDirectoryA
FindClose
FindFirstFileA
FindNextFileA
Sleep
GetCommandLineA
SetFilePointer
GetStartupInfoA
CreateProcessA
WaitForSingleObject
WriteFile
GetTickCount
SetLocalTime
FormatMessageA
GetLocalTime
SetEndOfFile
FlushFileBuffers
LocalAlloc
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
OpenProcess
GetDriveTypeA
GetLogicalDriveStringsA
DeleteFileA
MultiByteToWideChar
GetCurrentThread
LocalFree
GetCurrentThreadId
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetFileInformationByHandle
SystemTimeToFileTime
GetVersion
FindResourceA
LoadResource
LockResource
lstrcatA
lstrcpyA
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
GetTimeZoneInformation
SetLastError

user32

TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
LoadMenuA
GetSystemMenu
CreateMenu
wvsprintfA
KillTimer
InvertRect
DrawTextA
GetIconInfo
DrawIconEx
DrawIcon
CharLowerA
GetDialogBaseUnits
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
GetForegroundWindow
GetActiveWindow
GetDesktopWindow
SystemParametersInfoA
GetCursorPos
FindWindowExA
GetMenuStringA
GetWindow
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetKeyState
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
ClientToScreen
TabbedTextOutA
GrayStringA
UnhookWindowsHookEx
CreateDialogIndirectParamA
GetDlgCtrlID
GetMenuItemInfoA
GetWindowPlacement
GetMessagePos
GetMessageTime
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
MapWindowPoints
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
CreateDialogParamA
DialogBoxParamA
GetClassInfoExA
EndDialog
RegisterClassExA
SetActiveWindow
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageA
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
FillRect
SetClassLongA
GetClassLongA
SetRect
SetWindowRgn
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
GetWindowTextLengthA
GetMenuItemRect
GetMenuState
GetMenuInfo
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoA
SetMenuItemBitmaps
SetMenuDefaultItem
wsprintfA
PeekMessageA
GetMessageA
GetParent
TranslateAcceleratorA
IsDialogMessageA
TranslateMessage
DispatchMessageA
IsWindow
GetClassNameA
LoadIconA
GetDC
MsgWaitForMultipleObjects
CopyImage
CopyIcon
ReleaseDC
SetTimer
SetWindowPos
CreateIconFromResource
GetWindowTextA
CreatePopupMenu
AppendMenuA
DrawMenuBar
TrackPopupMenuEx
DestroyMenu
PostQuitMessage
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
PtInRect
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
SetParent
UpdateWindow
ValidateRect
InvalidateRect
ScreenToClient
GetFocus
GetDlgItem
CreateWindowExA
DestroyCursor
DestroyIcon
TrackMouseEvent
SetCursor
DefMDIChildProcA
SendMessageA
DefWindowProcA
DestroyWindow
GetClientRect
GetAsyncKeyState
CallWindowProcA
EndPaint
BeginPaint
LoadCursorA
MoveWindow
GetWindowRect
OpenIcon
PostMessageA
SetLayeredWindowAttributes
SetWindowLongA
GetWindowLongA
SetFocus

advapi32

RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegOpenKeyExA

shell32

DragAcceptFiles
Shell_NotifyIconA
DragFinish
DragQueryFileA
ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoFreeUnusedLibraries
CoRegisterMessageFilter
CLSIDFromString
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
OleRun
CoCreateInstance
CLSIDFromProgID
OleUninitialize
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
OleInitialize

gdi32

CreateRectRgn
GetDIBits
GetROP2
GetBkColor
GetTextColor
CreatePen
GetCurrentObject
CreateBrushIndirect
CreateBitmap
GetMapMode
GetTextMetricsA
TextOutA
GetCurrentPositionEx
Polygon
RoundRect
Rectangle
Escape
ExtTextOutA
RectVisible
PtVisible
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
RestoreDC
SaveDC
Pie
Chord
ArcTo
Ellipse
LineTo
MoveToEx
SetPixel
SetROP2
SetStretchBltMode
SetMapMode
SetBkColor
SetBkMode
SetTextColor
CreatePatternBrush
CreateSolidBrush
StretchBlt
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
BitBlt
SelectObject
DeleteDC
CreateDIBSection
CreateCompatibleDC
GetObjectA
DeleteObject
GetStockObject
CreateDIBitmap
CreateFontA
GetDeviceCaps
GetTextExtentPointA
GetPixel

comctl32

InitCommonControlsEx
ord17

wininet

FtpGetFileSize
FtpOpenFileA
HttpQueryInfoA
InternetReadFile
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetSetOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetGetConnectedState
InternetOpenUrlA

shlwapi

PathIsDirectoryA
PathFindFileNameA
StrTrimA
StrToIntExA
PathFileExistsA

winmm

PlaySoundA

atl

ord42
ord11
ord10
ord47

oleaut32

VarR8FromCy
VarR8FromBool
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
VariantChangeType
LoadTypeLi
SafeArrayDestroy
SysAllocString
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SystemTimeToVariantTime
OleLoadPicture
VariantInit

msimg32

GradientFill
AlphaBlend
TransparentBlt

oledlg

ord8

rasapi32

RasGetConnectStatusA
RasHangUpA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

wsock32

ntohs
getsockname
gethostname
recv
send
connect
htons
ioctlsocket
gethostbyname
socket
__WSAFDIsSet
inet_ntoa
WSAGetLastError
bind
listen
accept
inet_addr
WSAStartup
select
WSACleanup
closesocket

Sections

.text
Size: 844KB - Virtual size: 842KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 618KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b38aac1b845f6cf7b6c3897d06fc7e6

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

gdi32

comctl32

wininet

shlwapi

winmm

atl

oleaut32

msimg32

oledlg

rasapi32

winspool.drv

wsock32

Sections

.text Size: 844KB - Virtual size: 842KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 412KB - Virtual size: 618KB

.rsrc Size: 12KB - Virtual size: 11KB

.text
Size: 844KB - Virtual size: 842KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 412KB - Virtual size: 618KB

.rsrc
Size: 12KB - Virtual size: 11KB