blackmoon | 6510a0639c3318f07562a1ef4a4b21b077c857273d9e817204959e83b2b58a18

Sharing

Copy URL Twitter E-mail

General

Target

6510a0639c3318f07562a1ef4a4b21b077c857273d9e817204959e83b2b58a18
Size

460KB
MD5

0f8fffa7feb23890f1bc6010dcdf2517
SHA1

cde86638b06ae6eb5543a4cb3af4f59cec67fb02
SHA256

6510a0639c3318f07562a1ef4a4b21b077c857273d9e817204959e83b2b58a18
SHA512

659cc80cfc096a14d12f37faff2ed3e80807ae510ee8c17e12f0935a2d9d905434b72445e3783bc6eed87ac8eedd647e46a4b2e3e83985f810dfbbb1f757c474
SSDEEP

6144:ufeVxaAIC2We91849mKubjxO1htkKITjsaNg6LRX40l2BYST43dL:u2XanC2WGOfxOrkXsaNLlyf

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6510a0639c3318f07562a1ef4a4b21b077c857273d9e817204959e83b2b58a18

Files

6510a0639c3318f07562a1ef4a4b21b077c857273d9e817204959e83b2b58a18
.dll windows:4 windows x86 arch:x86

e663101ce3d28d16fa1654e55c5c3170

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetVersionExA
LoadLibraryA
FreeLibrary
HeapAlloc
RtlMoveMemory
HeapFree
GetProcessHeap
LocalSize
ExitProcess
HeapReAlloc
Sleep
CloseHandle
ReadFile
GetFileSize
CreateFileA
IsBadWritePtr
SetFilePointer
WriteFile
GetTickCount
MulDiv
GetDiskFreeSpaceA
GetCurrentDirectoryA
GetCommandLineA
GetModuleFileNameA
LCMapStringA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateThread
VirtualProtect
OpenProcess
OpenThread
CreateRemoteThread
ResumeThread
GetCurrentThreadId
MultiByteToWideChar
QueryDosDeviceA
GetLogicalDriveStringsA
VirtualFreeEx
GetSystemDirectoryA
GetTempPathA
GetTempFileNameA
WideCharToMultiByte
VirtualAllocEx
CopyFileA
WriteProcessMemory
ReadProcessMemory
VirtualAlloc
OutputDebugStringA
IsBadReadPtr
DeleteFileA
GetModuleHandleA

shlwapi

PathFindFileNameA

user32

GetSystemMetrics
GetMenu
SetMenu
DrawMenuBar
RegisterHotKey
UnregisterHotKey
SetActiveWindow
RegisterClassExA
CreateMenu
CreatePopupMenu
GetSystemMenu
LoadMenuA
DestroyMenu
AppendMenuA
GetMenuItemCount
InsertMenuA
SetMenuInfo
GetSubMenu
GetMenuItemID
CheckMenuRadioItem
SetForegroundWindow
TrackPopupMenu
GetMenuStringA
GetMenuItemInfoA
GetMenuItemRect
GetMenuState
GetMenuInfo
GetMenuDefaultItem
MenuItemFromPoint
RemoveMenu
CheckMenuItem
SetMenuItemInfoA
SetMenuItemBitmaps
SetMenuDefaultItem
wsprintfA
PeekMessageA
SetClassLongA
GetClassLongA
SetRect
SetWindowRgn
RemovePropA
GetPropA
SetPropA
MessageBoxA
SetWindowTextA
IsZoomed
GetWindowTextLengthA
EnableWindow
IsWindowEnabled
ShowWindow
IsWindowVisible
SetParent
PostMessageA
SetWindowPos
MoveWindow
IsIconic
FillRect
ReleaseCapture
SetCapture
DestroyWindow
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
SetFocus
GetClassNameA
GetDlgItem
GetWindowLongA
CreateWindowExA
DestroyCursor
SetWindowLongA
TrackMouseEvent
SetCursor
LoadCursorA
ReleaseDC
ScreenToClient
GetWindowRect
GetDC
DefMDIChildProcA
DefWindowProcA
CallWindowProcA
EndPaint
BeginPaint
RegisterWindowMessageA
IsWindow
DispatchMessageA
TranslateMessage
IsDialogMessageA
TranslateAcceleratorA
SendMessageA
GetParent
IsChild
GetFocus
GetMessageA
PostQuitMessage
LoadIconA
GetAsyncKeyState
GetWindowTextA
GetSysColor
MsgWaitForMultipleObjects
PostThreadMessageA
DestroyIcon

gdi32

CreatePatternBrush
StretchBlt
SetStretchBltMode
CreateSolidBrush
CreateRoundRectRgn
CombineRgn
ExtCreateRegion
SelectObject
DeleteDC
CreateDIBSection
CreateCompatibleDC
GetObjectA
GetStockObject
DeleteObject
SetBkColor
BitBlt
SetBkMode
SetTextColor

shell32

Shell_NotifyIconA
DragAcceptFiles
DragFinish
DragQueryFileA

comctl32

InitCommonControlsEx

atl

ord42

msvcrt

??2@YAPAXI@Z
??3@YAXPAX@Z
atof
malloc
free
_ftol
atoi
floor
_CIfmod
sprintf
strrchr
strchr
modf
realloc
memmove
strncmp
__CxxFrameHandler
calloc
_CIpow
_stricmp

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetSymLoadError
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
Initialize
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
RangeMapAddPeImageSections
RangeMapCreate
RangeMapFree
RangeMapRead
RangeMapRemove
RangeMapWrite
RemoveInvalidModuleList
ReportSymbolLoadSummary
SearchTreeForFile
SearchTreeForFileW
SetCheckUserInterruptShared
SetSymLoadError
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymAllocDiaString
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFreeDiaString
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymFunctionTableAccess64AccessRoutines
SymGetDiaSession
SymGetExtendedOption
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileChecksum
SymGetSourceFileChecksumW
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetDiaSession
SymSetExtendedOption
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
_EFN_DumpImage
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 244KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 180KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e663101ce3d28d16fa1654e55c5c3170

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

gdi32

shell32

comctl32

atl

msvcrt

Exports

Exports

Sections

.text Size: 244KB - Virtual size: 240KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 180KB - Virtual size: 239KB

.rsrc Size: 4KB - Virtual size: 664B

.reloc Size: 12KB - Virtual size: 9KB

.text
Size: 244KB - Virtual size: 240KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 180KB - Virtual size: 239KB

.rsrc
Size: 4KB - Virtual size: 664B

.reloc
Size: 12KB - Virtual size: 9KB