blackmoon | 428011ab0fca523349a9e952a5f55575b6eae3a2938d2d694dd15083527bd1e4

Sharing

Copy URL Twitter E-mail

General

Target

428011ab0fca523349a9e952a5f55575b6eae3a2938d2d694dd15083527bd1e4
Size

2.0MB
MD5

f0a4f8999fbe8a899e6577fc21cffc97
SHA1

127632bb986d9c9ec5a2ef0424d0ced45764d82d
SHA256

428011ab0fca523349a9e952a5f55575b6eae3a2938d2d694dd15083527bd1e4
SHA512

4dd904b8514697031fb2f61c0a6ed577cd841bcc16baaceada7354b46484244d83045e648f40dd00d1b07ff47e52abe9dd4bd63fa39d79b9f43dfd2dfef03ba1
SSDEEP

49152:EOB6fQdeP7+s8KuqGaX0ToIBAUZLYkS+:pV1JBAUZL5S+

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
428011ab0fca523349a9e952a5f55575b6eae3a2938d2d694dd15083527bd1e4

Files

428011ab0fca523349a9e952a5f55575b6eae3a2938d2d694dd15083527bd1e4
.dll windows:4 windows x86 arch:x86

c0246b0bd67cf4f976f90e593a1a33f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LCMapStringA
GetProcAddress
FreeLibrary
GetCommandLineA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
DeleteFileA
SetFileAttributesA
SetFilePointer
GetFileSize
ReadFile
CreateFileA
WriteFile
CloseHandle
FormatMessageA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
GetModuleFileNameA
IsBadReadPtr
HeapReAlloc
ExitProcess
LoadLibraryA
GetTempPathA
GetModuleHandleA
VirtualFree
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
GetTimeFormatA
GetDateFormatA
Sleep
OutputDebugStringA
lstrcmpA
lstrlenA
GetTickCount
GetACP
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
GlobalDeleteAtom
LocalFree
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
lstrcatA
lstrcpyA
lstrcpynA
GetVersion
MulDiv
GlobalFlags
WritePrivateProfileStringA
SetLastError
GetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
LockResource
LoadResource
FindResourceA
GetProcessVersion
GetCurrentProcess
FlushFileBuffers
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetVersionExA
IsBadWritePtr
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
SetStdHandle
InterlockedExchange
lstrcmpiW
HeapDestroy
HeapCreate
lstrcmpW
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
RtlZeroMemory
lstrlenW
InitializeCriticalSection
HeapFree
GetProcessHeap
RtlMoveMemory
VirtualAlloc
TerminateProcess
GetEnvironmentVariableA
VirtualProtect
VirtualQuery
GetLocalTime
CreateEventA

user32

IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
IsWindow
SetActiveWindow
GetSysColor
MapWindowPoints
UpdateWindow
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
PostThreadMessageA
DestroyMenu
CreateDialogIndirectParamA
EndDialog
IsDialogMessageA
GetWindowPlacement
SendDlgItemMessageA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
EnableWindow
SetCursor
PostMessageA
PostQuitMessage
SendMessageA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetSystemMetrics
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetCursorPos

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
DeleteObject
DeleteDC
SaveDC
RestoreDC
SelectObject
SetBkColor
GetObjectA
GetStockObject
PtVisible
GetDeviceCaps
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
GetClipBox
CreateBitmap

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegEnumKeyExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegOpenKeyExA

gdiplus

GdiplusStartup

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize

shlwapi

StrToIntW
StrToIntExW
PathFileExistsA

winhttp

WinHttpCrackUrl

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

oleaut32

VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SystemTimeToVariantTime
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime

oledlg

ord8

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comctl32

ord17

Exports

Exports

convercontent
decodecontent
delcache
initactivity
uninit

Sections

.text
Size: 936KB - Virtual size: 936KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 828KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.sedata
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0246b0bd67cf4f976f90e593a1a33f8

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

gdiplus

ole32

shlwapi

winhttp

crypt32

oleaut32

oledlg

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 936KB - Virtual size: 936KB

.rdata Size: 828KB - Virtual size: 828KB

.data Size: 124KB - Virtual size: 208KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: - Virtual size: 48KB

.sedata Size: 140KB - Virtual size: 140KB

.idata Size: 8KB - Virtual size: 8KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 936KB - Virtual size: 936KB

.rdata
Size: 828KB - Virtual size: 828KB

.data
Size: 124KB - Virtual size: 208KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: - Virtual size: 48KB

.sedata
Size: 140KB - Virtual size: 140KB

.idata
Size: 8KB - Virtual size: 8KB

.reloc
Size: 32KB - Virtual size: 32KB