Behavioral task
behavioral1
Sample
1080d9514e3a3706fac870bebca5c613e8855431c66d61354d2c6641ae421d4f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1080d9514e3a3706fac870bebca5c613e8855431c66d61354d2c6641ae421d4f.exe
Resource
win10v2004-20240508-en
General
-
Target
1080d9514e3a3706fac870bebca5c613e8855431c66d61354d2c6641ae421d4f
-
Size
2.5MB
-
MD5
70b1d2e3182e366ead6a686173cf5e4b
-
SHA1
f9d131fcfe1c36ca2f6592ae74295737e6fbb83f
-
SHA256
1080d9514e3a3706fac870bebca5c613e8855431c66d61354d2c6641ae421d4f
-
SHA512
3754bf3baea7e4095a23a43597217fe4574c1629989a2611d4b0c2d3f48496033d50f02d565c46821fd2a545d4befc0e068474258d2a4d0dfaa9490e5db26fc8
-
SSDEEP
49152:1FErGYQAitzK8ChMkaJGlOJ3UVlDKYvFa/vVSWSpX:PG/iAq0OaMYvv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1080d9514e3a3706fac870bebca5c613e8855431c66d61354d2c6641ae421d4f
Files
-
1080d9514e3a3706fac870bebca5c613e8855431c66d61354d2c6641ae421d4f.exe windows:4 windows x86 arch:x86
c334547ab95879315b6c084dd298260d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
SetStdHandle
GetStringTypeW
GetStringTypeA
SetWaitableTimer
CreateWaitableTimerA
IsBadWritePtr
GetVersionExA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GlobalUnlock
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
RtlUnwind
GetStartupInfoA
GetOEMCP
GetCPInfo
FlushFileBuffers
SetFilePointer
SetErrorMode
GetProcessVersion
FindResourceA
LoadResource
LockResource
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
SetLastError
lstrcpyA
lstrcatA
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
LocalFree
LocalAlloc
lstrcpynA
InitializeCriticalSection
LCMapStringA
FreeLibrary
GetCommandLineA
GlobalFree
WriteFile
MoveFileA
DeleteFileA
GetEnvironmentVariableA
CreateFileA
GetFileSize
ReadFile
WritePrivateProfileStringA
GetLocalTime
GetPrivateProfileStringA
GetModuleFileNameA
IsBadReadPtr
SetUnhandledExceptionFilter
HeapReAlloc
GlobalLock
GlobalAlloc
GetModuleHandleA
GetCurrentProcessId
lstrcmpW
lstrcmpiA
HeapDestroy
HeapCreate
MulDiv
GetAtomNameW
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
RtlZeroMemory
MultiByteToWideChar
lstrcatW
lstrcmpiW
lstrcmpA
lstrlenA
LocalSize
LeaveCriticalSection
TerminateProcess
OpenProcess
GetCurrentProcess
CreateProcessA
EnterCriticalSection
WaitForSingleObject
HeapFree
InterlockedDecrement
InterlockedIncrement
HeapAlloc
GlobalDeleteAtom
RtlMoveMemory
CreateThread
GetCurrentThreadId
WideCharToMultiByte
lstrlenW
GetTickCount
Process32Next
GetCurrentThread
CloseHandle
Process32First
CreateToolhelp32Snapshot
IsBadCodePtr
CreateEventA
OpenEventA
GetProcAddress
LoadLibraryA
GetEnvironmentStrings
GetProcessHeap
VirtualFree
LCMapStringW
VirtualAlloc
user32
GetDoubleClickTime
keybd_event
wvsprintfA
SetWindowRgn
BeginPaint
EndPaint
TrackMouseEvent
GetDlgItem
GetAncestor
SetWindowLongW
GetAsyncKeyState
IsWindow
FindWindowExW
GetClassNameW
GetWindowLongW
SendMessageW
DestroyCursor
SetCursor
GetClientRect
SetCapture
ReleaseCapture
LoadCursorW
DestroyIcon
DestroyAcceleratorTable
GetSysColor
IsWindowEnabled
EnableWindow
GetIconInfo
GetNextDlgTabItem
SetFocus
GetDC
DrawTextA
ReleaseDC
OffsetRect
DefWindowProcW
GetWindowDC
FillRect
GetFocus
GetMessageW
IsChild
TranslateMDISysAccel
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
CreateDialogIndirectParamA
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
MapWindowPoints
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
CreateWindowExA
GetClassLongA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
GetWindowPlacement
SetWindowLongA
SetActiveWindow
mouse_event
GetParent
GrayStringA
TabbedTextOutA
UnhookWindowsHookEx
GetWindowTextA
SetWindowTextA
GetWindow
GetDlgCtrlID
PtInRect
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetActiveWindow
GetKeyState
CallNextHookEx
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SendMessageA
PostMessageA
PostQuitMessage
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CreateDialogIndirectParamW
GetClassLongW
SetClassLongW
DestroyWindow
DialogBoxIndirectParamW
EndDialog
CreateDialogParamW
DialogBoxParamW
CreateMDIWindowW
CallWindowProcW
ShowWindow
PostMessageW
CopyIcon
ScreenToClient
InvalidateRect
ValidateRect
UpdateWindow
SetParent
SetWindowTextW
MessageBoxW
SetTimer
KillTimer
SetPropW
SetPropA
GetPropW
GetPropA
RemovePropW
RemovePropA
EnumPropsExW
LoadIconW
SetRect
IsZoomed
GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterWindowMessageW
GetDialogBaseUnits
MapDialogRect
GetDlgItemInt
SetDlgItemInt
AttachThreadInput
OpenIcon
IsIconic
SetWindowPos
GetWindowTextW
GetWindowTextLengthW
GetDlgItemTextW
SetDlgItemTextW
SetCursorPos
ClientToScreen
MoveWindow
GetWindowRect
WaitForInputIdle
MsgWaitForMultipleObjects
SendDlgItemMessageW
SystemParametersInfoW
CreateIconFromResourceEx
LoadImageW
IsDialogMessageA
GetClassNameA
DrawIconEx
UpdateLayeredWindow
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuW
GetMenuInfo
DestroyMenu
GetWindowThreadProcessId
SendDlgItemMessageA
IsWindowVisible
GetMenuItemCount
GetMenuItemInfoW
AppendMenuW
InsertMenuW
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringW
GetMenuItemRect
GetMenuState
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoW
SetMenuDefaultItem
LoadStringW
CharUpperW
CharLowerW
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
FindWindowExA
gdi32
GetDIBits
CreateDIBitmap
CreatePatternBrush
CreateEllipticRgn
StretchBlt
SetStretchBltMode
GetStretchBltMode
BitBlt
CreateDIBSection
CreateCompatibleDC
CreateRoundRectRgn
CreateFontIndirectW
GetObjectW
CreateSolidBrush
GetStockObject
SetBkColor
SetBkMode
SetTextColor
DeleteDC
SelectObject
DeleteObject
GetObjectA
CreateBitmap
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
comctl32
ImageList_GetBkColor
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragEnter
ImageList_BeginDrag
ImageList_DrawEx
ImageList_Draw
ImageList_Write
ImageList_GetImageInfo
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_SetIconSize
ImageList_GetIcon
ImageList_SetBkColor
ord17
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_Duplicate
ImageList_Copy
ImageList_AddMasked
ImageList_Add
ImageList_GetIconSize
ImageList_AddIcon
ImageList_LoadImageW
ImageList_Read
ImageList_Create
ImageList_Destroy
InitCommonControlsEx
wsock32
WSAStartup
gethostname
WSACleanup
advapi32
RegCreateKeyExA
RegSetValueExA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegCloseKey
RegOpenKeyExA
gdiplus
GdipGetCellAscent
GdipDeletePrivateFontCollection
GdipCreateFontFromDC
GdipIsStyleAvailable
GdipCloneFontFamily
GdipCreateFontFamilyFromName
GdipCreateFontFromLogfontA
GdipCloneFont
GdipCreateFromHDC
GdipGetLogFontW
GdipGetLogFontA
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontUnit
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdiplusStartup
GdipDeletePath
GdipDeleteRegion
GdipGetFontCollectionFamilyList
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipCloneImageAttributes
GdipSetImageAttributesToIdentity
GdipResetImageAttributes
GdipSetImageAttributesThreshold
GdipSetImageAttributesNoOp
GdipSetImageAttributesGamma
GdipSetImageAttributesColorKeys
GdipSetImageAttributesOutputChannel
GdipSetImageAttributesOutputChannelColorProfile
GdipDeleteFontFamily
GdipDeleteFont
GdipCreateTexture
GdipFillRectangle
GdipDeleteBrush
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDisposeImage
GdipSetImageAttributesRemapTable
GdipSetImageAttributesWrapMode
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipVectorTransformMatrixPoints
GdipTransformMatrixPoints
GdipShearMatrix
GdipScaleMatrix
GdipInvertMatrix
GdipMultiplyMatrix
GdipGetMatrixElements
GdipSetMatrixElements
GdipCloneMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipRotateMatrix
GdipTranslateMatrix
GdipCreateMatrix
GdipCreateSolidFill
GdipBitmapSetResolution
GdipCloneBitmapArea
GdipCreateBitmapFromResource
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetRegionScans
GdipGetRegionScansCount
GdipIsVisibleRegionRect
GdipIsVisibleRegionPoint
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionBounds
GdipTransformRegion
GdipTranslateRegion
GdipCombineRegionPath
GdipCombineRegionRegion
GdipCombineRegionRect
GdipSetEmpty
GdipSetInfinite
GdipCloneRegion
GdipCreateRegionRgnData
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRect
GdipIsOutlineVisiblePathPoint
GdipIsVisiblePathPoint
GdipWarpPath
GdipWindingModeOutline
GdipWidenPath
GdipFlattenPath
GdipGetPathWorldBounds
GdipTransformPath
GdipAddPathString
GdipAddPathPath
GdipAddPathPolygon
GdipAddPathPie
GdipAddPathEllipse
GdipAddPathArcI
GdipGetCellDescent
GdipGetGenericFontFamilySansSerif
GdipAddPathClosedCurve2
GdipAddPathClosedCurve
GdipAddPathCurve2
GdipAddPathCurve
GdipAddPathBezier
GdipAddPathArc
GdipAddPathLine
GdipGetPathLastPoint
GdipReversePath
GdipClearPathMarkers
GdipSetPathMarker
GdipClosePathFigures
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathData
GdipGetPointCount
GdipSetPathFillMode
GdipGetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath2
GdipCreatePath
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipCreateHICONFromBitmap
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageThumbnail
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageBounds
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipCloneImage
GdipGetFontCollectionFamilyCount
GdipLoadImageFromFile
GdipEndContainer
GdipBeginContainer2
GdipBeginContainer
GdipRestoreGraphics
GdipSaveGraphics
GdipIsVisibleRect
GdipIsVisiblePoint
GdipIsVisibleClipEmpty
GdipIsClipEmpty
GdipGetVisibleClipBounds
GdipGetClipBounds
GdipGetClip
GdipTranslateClip
GdipResetClip
GdipSetClipHrgn
GdipSetClipRegion
GdipSetClipRect
GdipSetClipPath
GdipSetClipGraphics
GdipDrawImagePointsRect
GdipDrawImagePointRect
GdipDrawImagePoints
GdipDrawImageRect
GdipDrawImageRectRect
GdipDrawImage
GdipDrawDriverString
GdipMeasureCharacterRanges
GdipCreateRegion
GdipMeasureString
GdipDrawString
GdipFillRegion
GdipFillClosedCurve2
GdipFillClosedCurve
GdipFillPath
GdipFillPie
GdipFillEllipse
GdipFillPolygon
GdipGraphicsClear
GdipDrawClosedCurve2
GdipDrawClosedCurve
GdipDrawCurve2
GdipDrawCurve
GdipDrawPath
GdipDrawPolygon
GdipDrawPie
GdipDrawEllipse
GdipDrawRectangle
GdipDrawBezier
GdipDrawArc
GdipDrawLine
GdipGetNearestColor
GdipTransformPointsI
GdipTransformPoints
GdipGetDpiY
GdipGetDpiX
GdipGetPageScale
GdipSetPageScale
GdipGetPageUnit
GdipSetPageUnit
GdipRotateWorldTransform
GdipScaleWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipDeleteMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipReleaseDC
GdipGetDC
GdipFlush
GdipGetGenericFontFamilySerif
GdipGetGenericFontFamilyMonospace
GdipAddPathRectangle
GdipGetFamilyName
GdipGetLineSpacing
GdipCreateFont
GdipAddPathLineI
GdipCreateFontFromLogfontW
GdipCreateHBITMAPFromBitmap
GdipSetImageAttributesColorMatrix
GdipGetEmHeight
GdipGetImageAttributesAdjustedPalette
GdipLoadImageFromStream
shell32
DragAcceptFiles
CommandLineToArgvW
Shell_NotifyIconW
DragFinish
DragQueryFileW
atl
ord42
shlwapi
wvnsprintfW
StrToIntW
StrTrimW
PathFindFileNameW
PathRemoveFileSpecW
StrToIntExW
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
ole32
CLSIDFromString
GetHGlobalFromStream
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
oledlg
ord8
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
Sections
.text Size: 896KB - Virtual size: 892KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.5MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE