blackmoon | aee5baf7f47a034dd855403488001b19_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aee5baf7f47a034dd855403488001b19_JaffaCakes118
Size

632KB
MD5

aee5baf7f47a034dd855403488001b19
SHA1

9f2c7f2cf6e823549e39d4a957533f3dd60eee59
SHA256

2f41e4ec705e90d70c1e35c283c9a0ae25650aafee0a917bd8c5e9aaca3d2e5e
SHA512

caf8b2614196456a2ff4e87391e12c8907e6bfd212bb8b1a95754d31a7f4046353825074951c67200871c52a9cf52e1e946bec7fd71925dc970c51a4b401e951
SSDEEP

12288:dEF/1YHC9Luhqx35AE3qU7DQMTRT2vD+KOi:dEF/+Hcuq3mE37DQuRT2KZ

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aee5baf7f47a034dd855403488001b19_JaffaCakes118

Files

aee5baf7f47a034dd855403488001b19_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d37954d9aaa733a301fa1c22e0548343

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
WritePrivateProfileStringA
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetCommandLineA
LCMapStringA
GetSystemDirectoryA
GetCurrentDirectoryA
GetDiskFreeSpaceExA
GetModuleFileNameA
Sleep
GetStartupInfoA
CreateProcessA
WriteFile
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
QueryDosDeviceA
GetLogicalDriveStringsA
GetTempPathA
GetVersionExA
UnhandledExceptionFilter
FileTimeToSystemTime
GetTimeZoneInformation
SetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
GetLastError
EnterCriticalSection
lstrcpyA
FreeLibrary
LoadLibraryA
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
FileTimeToLocalFileTime
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetProcAddress
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
lstrcmpiA
GetFileAttributesA
GetFileSize
GetFileTime
lstrcmpA
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsBadCodePtr
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStdHandle
SetHandleCount
LCMapStringW
TerminateProcess
GetFileType
SetStdHandle
HeapSize
GetACP
GetSystemTime
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVersion
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
MultiByteToWideChar
CopyFileA
CreateFileA
LocalAlloc
LocalFree
lstrcpynA
RtlMoveMemory
GetModuleHandleA
CreateRemoteThread
GetCurrentThreadId
WideCharToMultiByte
DebugActiveProcessStop
ContinueDebugEvent
WaitForDebugEvent
DebugActiveProcess
Module32First
InitializeCriticalSection
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
WriteProcessMemory
VirtualProtectEx
WaitForSingleObject
CreateThread
GetTempFileNameA
DeviceIoControl
DeleteFileA
ReadFile
SetFilePointer
ReadProcessMemory

user32

MoveWindow
RegisterWindowMessageA
GetWindowThreadProcessId
EnumWindows
IsWindowVisible
GetWindowTextA
GetClassNameA
GetWindowTextLengthA
GetDesktopWindow
GetWindow
PostThreadMessageA
MsgWaitForMultipleObjects
SetTimer
GetAsyncKeyState
CallWindowProcA
BeginPaint
EndPaint
SendMessageA
GetMessageA
PeekMessageA
TranslateMessage
DispatchMessageA
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuInfo
GetMenuState
GetMenuItemRect
GetMenuItemInfoA
GetMenuStringA
TrackPopupMenu
SetForegroundWindow
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
SetMenuInfo
InsertMenuA
GetMenuItemCount
AppendMenuA
DestroyMenu
LoadMenuA
GetSystemMenu
CreatePopupMenu
CreateMenu
KillTimer
GetDialogBaseUnits
SendDlgItemMessageA
SetDlgItemTextA
GetDlgItemTextA
SetDlgItemInt
GetDlgItemInt
CreateDialogParamA
DialogBoxParamA
RegisterClassExA
GetClassInfoExA
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
FillRect
SetClassLongA
SetWindowRgn
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
EnableWindow
IsWindowEnabled
ShowWindow
SetParent
PostMessageA
SetWindowPos
GetSysColor
ScreenToClient
GetParent
UpdateWindow
ValidateRect
InvalidateRect
GetWindowRect
GetFocus
SetFocus
IsWindow
GetDlgItem
GetWindowLongA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
UnhookWindowsHookEx
SetWindowLongA
DestroyIcon
TrackMouseEvent
SetCursor
DefMDIChildProcA
DestroyWindow
EndDialog
GetClientRect
GetNextDlgTabItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
PtInRect
LoadCursorA
GetSysColorBrush
PostQuitMessage
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
ClientToScreen
LoadIconA
MapWindowPoints
AdjustWindowRectEx
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetDlgCtrlID
GetMessagePos
GetForegroundWindow
SystemParametersInfoA
GetWindowPlacement
GetLastActivePopup
LoadStringA
UnregisterClassA
CopyRect
GetKeyState
CharUpperA
GetMessageTime
DefWindowProcA

gdi32

SetBkMode
SetTextColor
CreateRoundRectRgn
CreatePatternBrush
CreateSolidBrush
StretchBlt
GetObjectA
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetStockObject
DeleteObject
SetBkColor
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC

advapi32

RegCreateKeyExA
RegEnumValueA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
RegSetValueExA
RegCloseKey
StartServiceA
CreateServiceA
CloseServiceHandle
RegOpenKeyExA

shlwapi

PathFileExistsA
PathFindFileNameA

shell32

DragFinish
ShellExecuteA
Shell_NotifyIconA
DragAcceptFiles
DragQueryFileA

atl

ord47
ord42

ntdll

LdrQueryProcessModuleInformation
RtlDecompressBuffer
ZwClose
ZwAddAtom
RtlMoveMemory
LdrGetProcedureAddress
LdrLoadDll
LdrGetDllHandle
LdrUnloadDll

ole32

CoUninitialize
CoInitialize

oleaut32

SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VarR8FromBool
VarR8FromCy

rasapi32

RasDialA
RasEnumConnectionsA
RasEnumEntriesA
RasGetEntryDialParamsA
RasGetConnectStatusA
RasHangUpA

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17

wsock32

socket
WSASetLastError
gethostbyname
ioctlsocket
htons
setsockopt
send
recv
closesocket
select
gethostname
WSACleanup
WSAStartup
connect

wininet

InternetOpenA
InternetCloseHandle
InternetSetOptionA
InternetConnectA
FtpDeleteFileA
FtpRenameFileA
FtpCreateDirectoryA
FtpRemoveDirectoryA
FtpSetCurrentDirectoryA
FtpGetCurrentDirectoryA
FtpPutFileA
FtpGetFileA
InternetFindNextFileA
FtpFindFirstFileA
InternetReadFile
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpQueryInfoA
HttpSendRequestA

Sections

.text
Size: 352KB - Virtual size: 351KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d37954d9aaa733a301fa1c22e0548343

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shlwapi

shell32

atl

ntdll

ole32

oleaut32

rasapi32

comdlg32

winspool.drv

comctl32

wsock32

wininet

Sections

.text Size: 352KB - Virtual size: 351KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 240KB - Virtual size: 292KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 352KB - Virtual size: 351KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 240KB - Virtual size: 292KB

.rsrc
Size: 4KB - Virtual size: 2KB