blackmoon | 32e7d2899718bfb9d6a4c986cda6ea91a9794fc729e1be56e822aab0eddf1cca[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

32e7d2899718bfb9d6a4c986cda6ea91a9794fc729e1be56e822aab0eddf1cca.exe
Size

7.1MB
MD5

62b3d8cd7578a9f375898cbe8f297296
SHA1

905e3dbb84b70f0ea4ecd26f643f866369f1cf23
SHA256

32e7d2899718bfb9d6a4c986cda6ea91a9794fc729e1be56e822aab0eddf1cca
SHA512

ef335eccadea8fcd1ea98a0ca5a86097d35688a423f68504f77484870b4dbbe533787b56d0e5797000f64341f7d2bc8966bbced870c90abc8693260bc6908a0a
SSDEEP

196608:y3DJVEw6pMrEFkdMmwcgsplRM8hlhnj0CnC:A0w+ZkG2pF

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32e7d2899718bfb9d6a4c986cda6ea91a9794fc729e1be56e822aab0eddf1cca.exe

Files

32e7d2899718bfb9d6a4c986cda6ea91a9794fc729e1be56e822aab0eddf1cca.exe
.exe windows:4 windows x86 arch:x86

e71328be56cd76b69c767d86407e29ca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

PlaySoundA

kernel32

GetTempPathW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetFullPathNameW
GetFullPathNameA
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
LCMapStringA
FreeLibrary
GetCommandLineA
GetLocalTime
FindClose
FindFirstFileA
FindNextFileA
SetFilePointer
CopyFileA
DeleteFileA
CreateDirectoryA
FormatMessageA
GetUserDefaultLCID
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
CreateFileA
GetFileSize
ReadFile
GetStartupInfoA
CreateProcessA
WaitForSingleObject
IsBadReadPtr
HeapReAlloc
ExitProcess
GetModuleHandleA
LocalSize
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetNativeSystemInfo
SetSystemPowerState
GetModuleFileNameA
HeapAlloc
GetProcessHeap
ReleaseMutex
LoadLibraryA
MoveFileW
DeleteFileW
GlobalSize
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
VirtualFree
VirtualAlloc
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
TerminateProcess
RtlMoveMemory
CreateMutexA
OpenMutexA
CloseHandle
OpenProcess
SetThreadExecutionState
lstrcpynW
FormatMessageW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
EnumSystemLocalesA
GetLocaleInfoA
HeapCreate
IsValidLocale
LCMapStringW
IsBadWritePtr
GetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
SetStdHandle
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
SetErrorMode
GetProcessVersion
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcatA
GlobalFlags
MulDiv
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
HeapValidate
LocalAlloc
lstrcpyA
lstrcpynA
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
SetLastError
GetTimeZoneInformation
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
QueryPerformanceCounter
SetEndOfFile
Sleep
SystemTimeToFileTime
UnlockFile
UnlockFileEx
UnmapViewOfFile
GetCurrentProcess
GetLastError
GetVersionExA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
DeleteCriticalSection
CreateThread
lstrlenA
GetTickCount
CreateMutexW
CreateFileMappingW
CreateFileMappingA
GetACP
InterlockedCompareExchange
AreFileApisANSI
HeapDestroy
IsValidCodePage
HeapSize
CreateFileW
FlushFileBuffers

user32

SetWindowPos
SetPropA
GetClassLongW
GetParent
SetWindowRgn
GetSystemMetrics
ReleaseDC
SetCaretPos
wsprintfA
SetCapture
GetMessageA
PeekMessageA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
IsZoomed
EndPaint
SetWindowLongW
GetMessageW
GetPropA
GetClassNameW
SendMessageW
IsIconic
TrackMouseEvent
CallWindowProcW
LoadCursorFromFileW
ReleaseCapture
UpdateLayeredWindow
CreateWindowExW
SystemParametersInfoA
MessageBeep
SetActiveWindow
MoveWindow
GetWindowRect
IsWindow
ShowWindow
SetTimer
SetFocus
SetForegroundWindow
GetFocus
MessageBoxA
DispatchMessageA
BeginPaint
TranslateMessage
DispatchMessageW
RemovePropA
PostMessageW
CreateIconFromResourceEx
CopyImage
MsgWaitForMultipleObjects
RegisterClassExW
DefWindowProcW
IsWindowVisible
KillTimer
DestroyWindow
GetWindowTextW
LoadCursorW
EnableWindow
IsWindowEnabled
GetForegroundWindow
GetActiveWindow
SetWindowTextA
PostQuitMessage
PostMessageA
GetWindowLongA
GetLastActivePopup
SetWindowsHookExA
ValidateRect
CallNextHookEx
PtInRect
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
GetWindowTextA
GetClassNameA
GetDlgCtrlID
GetWindow
ClientToScreen
UnhookWindowsHookEx
GetMenuItemCount
GetDC
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
SendDlgItemMessageA
IsDialogMessageA
SetWindowLongA
GetWindowPlacement
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
UpdateWindow
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
UnregisterClassA
PostThreadMessageA
DestroyMenu
CreateDialogIndirectParamA
EndDialog
LookupIconIdFromDirectoryEx
SetCursor
SendMessageA
GetKeyState
InvalidateRect
IntersectRect
GetAsyncKeyState
GetCursorPos

gdi32

ScaleWindowExtEx
GetClipBox
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetMapMode
GetStockObject
GetObjectA
GetDeviceCaps
GetDIBits
CreateRectRgn
CreateRoundRectRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
BitBlt
SetTextColor
SetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetBkColor
RestoreDC
SaveDC
CreateBitmap
SetViewportOrgEx

advapi32

RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
LookupAccountSidA
RegCloseKey
RegQueryValueExA
RegOpenKeyA

shell32

SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
Shell_NotifyIconW
ShellExecuteW
SHFileOperationW
SHGetDiskFreeSpaceExA
ord680
SHGetMalloc

ole32

CreateStreamOnHGlobal
StringFromGUID2
CLSIDFromString
OleRun
CoCreateInstance
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoUninitialize
CoInitialize

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetSetOptionA
InternetConnectA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpQueryInfoW

psapi

GetProcessImageFileNameA

wtsapi32

WTSEnumerateProcessesA
WTSFreeMemory

gdiplus

GdipFillPolygon
GdipCreatePen2
GdipCreateLineBrush
GdipFillPath
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetStringFormatFlags
GdipGetStringFormatTrimming
GdipGetStringFormatAlign
GdipSetStringFormatFlags
GdipGetFontHeight
GdipCreateLineBrushFromRect
GdipDrawPolygon
GdipAddPathArc
GdipDrawPath
GdipCreateHBITMAPFromBitmap
GdipGetCompositingQuality
GdipDeletePath
GdipCreatePath
GdipCreatePathGradientFromPath
GdipDeleteFont
GdipGetImageEncoders
GdipDrawImageRect
GdipDeletePen
GdipCreateStringFormat
GdipDrawString
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipClosePathFigure
GdipLoadImageFromStream
GdipCreateFont
GdipGetFontStyle
GdipGetFontSize
GdipGetFamilyName
GdipCreateSolidFill
GdipDeleteBrush
GdipFillRectangle
GdipGraphicsClear
GdipSetClipRect
GdipDisposeImage
GdipDrawImageRectRect
GdipGetImageHeight
GdipGetImageWidth
GdipCloneBitmapArea
GdipGetImagePixelFormat
GdipMeasureString
GdipDeleteFontFamily
GdipCreateRegionHrgn
GdipCreateFontFamilyFromName
GdipDeleteRegion
GdipGetRegionBounds
GdipMeasureCharacterRanges
GdipCreateRegion
GdipSetStringFormatMeasurableCharacterRanges
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipDeleteStringFormat
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetCompositingQuality
GdipSetInterpolationMode
GdipDeleteGraphics
GdipGetTextRenderingHint
GdiplusStartup
GdipCreateImageAttributes
GdipSetClipRegion
GdipDrawRectangle
GdipSetPenDashStyle
GdipResetClip
GdipCreateFromHDC
GdipGetSmoothingMode
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix

oleaut32

VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
OleLoadPicture

shlwapi

PathFileExistsW
PathFileExistsA

imm32

ImmGetContext
ImmAssociateContext

oledlg

ord8

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17

rasapi32

RasHangUpA
RasGetConnectStatusA

wsock32

WSAStartup
WSACleanup
select
closesocket
recv
send

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 848KB - Virtual size: 844KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.6MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 348KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e71328be56cd76b69c767d86407e29ca

Headers

File Characteristics

Imports

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

psapi

wtsapi32

gdiplus

oleaut32

shlwapi

imm32

oledlg

winspool.drv

comctl32

rasapi32

wsock32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 848KB - Virtual size: 844KB

.data Size: 4.6MB - Virtual size: 4.8MB

.rsrc Size: 348KB - Virtual size: 345KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 848KB - Virtual size: 844KB

.data
Size: 4.6MB - Virtual size: 4.8MB

.rsrc
Size: 348KB - Virtual size: 345KB