blackmoon | 0e2e00f979d19fe4636db65567effb8a2089ec26bc2c3b7f9bea8c78fa7c211f

Sharing

Copy URL Twitter E-mail

General

Target

0e2e00f979d19fe4636db65567effb8a2089ec26bc2c3b7f9bea8c78fa7c211f
Size

14.4MB
MD5

dee6c65b57a2cacfa5dec5302ef8d1c7
SHA1

4eb7aa260cb4b987959feb5dec58443a6ade5aef
SHA256

0e2e00f979d19fe4636db65567effb8a2089ec26bc2c3b7f9bea8c78fa7c211f
SHA512

1b37e1b5b4283d37480da695f0100d7fa6c6b79c34da67946b035e4f8c70ff908a81a02f5549f07a46ddf9e287406aa10aafed0ea12134212273ce0c14153752
SSDEEP

196608:24gwELzUWRzlWvM0vhHds3a8n8F5g12gqGKvmyPxojWSfJVRw:ZMrGM0vrGCJGKOy5ojWSf

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e2e00f979d19fe4636db65567effb8a2089ec26bc2c3b7f9bea8c78fa7c211f

Files

0e2e00f979d19fe4636db65567effb8a2089ec26bc2c3b7f9bea8c78fa7c211f
.exe windows:4 windows x86 arch:x86

3b640379969e55b268ebf159ba5d5903

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA
AVIStreamGetFrame

iphlpapi

GetAdaptersInfo

shlwapi

PathFindFileNameA
StrToIntW
StrStrW
StrToIntExW
StrStrA
StrTrimW
StrStrIW
StrRStrIW
StrCmpNA

winmm

midiStreamOut
midiOutPrepareHeader
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
midiStreamProperty
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
midiStreamStop
midiOutReset
midiStreamClose
midiStreamRestart
PlaySoundA

ws2_32

gethostname
inet_addr
gethostbyname
recv
send
connect
closesocket
inet_ntoa
WSASocketA
WSAStartup
WSACleanup
accept
__WSAFDIsSet
ntohs
getsockname
select
WSAAsyncSelect
htons
bind
htonl
socket
sendto
recvfrom
ioctlsocket
listen
setsockopt
getpeername

kernel32

GetLastError
GetFullPathNameA
GetUserDefaultLCID
GlobalReAlloc
FindNextFileA
lstrcpyA
WinExec
lstrcatA
ExitProcess
GetModuleFileNameA
WritePrivateProfileStringA
LockResource
LoadResource
FindResourceA
WaitForMultipleObjects
GetProfileStringA
ReleaseSemaphore
ResumeThread
CreateSemaphoreA
SetSystemPowerState
LoadLibraryExA
Beep
GlobalMemoryStatus
SetLastError
GetTimeZoneInformation
GetVersion
GetCurrentThread
DuplicateHandle
GetSystemTime
GetTempFileNameA
LocalFree
FormatMessageA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetThreadLocale
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
LocalAlloc
GlobalHandle
TlsFree
LocalReAlloc
GetFileTime
GlobalFlags
GetProfileIntA
SetErrorMode
GetProcessVersion
GetCPInfo
GetOEMCP
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
GetACP
SetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
CompareStringA
CompareStringW
IsBadCodePtr
GetPrivateProfileStringA
OutputDebugStringA
ExpandEnvironmentStringsA
FindFirstFileA
FindClose
SetFileAttributesA
GetVersionExA
MoveFileA
DeleteFileA
CopyFileA
CreateDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
MulDiv
SetLocalTime
GetCommandLineA
GetSystemInfo
PulseEvent
OpenEventA
TryEnterCriticalSection
DeleteCriticalSection
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
ChangeTimerQueueTimer
CreateTimerQueue
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
WriteFile
lstrcmpiA
GetFileSize
CreateFileW
lstrcmpA
lstrcmpiW
HeapDestroy
HeapCreate
lstrcmpW
RtlZeroMemory
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
VirtualFree
VirtualAlloc
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
SetEvent
ReleaseMutex
CreateMutexA
GetLogicalDriveStringsA
GetTickCount
ReadDirectoryChangesW
Module32Next
WriteProcessMemory
VirtualProtectEx
VirtualFreeEx
CreateRemoteThread
VirtualAllocEx
CreateProcessA
FileTimeToSystemTime
FileTimeToLocalFileTime
OpenProcess
GetProcessTimes
GetExitCodeThread
GetComputerNameA
GetDiskFreeSpaceExA
SetWaitableTimer
CreateWaitableTimerA
GetTimeFormatA
GetDateFormatA
InterlockedDecrement
IsBadWritePtr
InterlockedExchangeAdd
GlobalFree
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
InterlockedIncrement
lstrcpynA
ReadProcessMemory
IsBadReadPtr
TlsGetValue
TlsSetValue
GetLocalTime
lstrlenA
Sleep
GetQueuedCompletionStatus
CreateThread
PostQueuedCompletionStatus
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
HeapFree
lstrlenW
HeapAlloc
GetProcessHeap
GetCurrentThreadId
InterlockedExchange
InterlockedCompareExchange
VirtualQueryEx
GetCurrentProcess
RtlMoveMemory
WaitForSingleObject
LocalSize
GetTempPathA
MultiByteToWideChar
lstrcpyn
GetProcAddress
GetModuleHandleA
SetFilePointer
ReadFile
GetFileSizeEx
CloseHandle
CreateFileA
TerminateProcess
GetShortPathNameA
LoadLibraryA
TlsAlloc
CreateIoCompletionPort
ResetEvent
CreateEventA
SetEnvironmentVariableA
GetFileAttributesA
RemoveDirectoryA

user32

CharUpperA
CreateDialogIndirectParamA
EndDialog
GetWindowPlacement
RegisterWindowMessageA
GetLastActivePopup
GetMessageTime
GetClassLongA
RegisterClassA
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
GetMenuCheckMarkDimensions
wvsprintfA
CharNextA
SetWindowContextHelpId
MapDialogRect
GetSysColorBrush
GetNextDlgGroupItem
GetDesktopWindow
CreateIconIndirect
GetIconInfo
CopyIcon
LoadStringA
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowTextA
GetClassNameA
ExitWindowsEx
DrawStateA
FrameRect
GetNextDlgTabItem
LoadIconA
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
ModifyMenuA
CreateAcceleratorTableA
GetDlgCtrlID
EnableMenuItem
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
GetClassInfoA
DeleteMenu
DestroyAcceleratorTable
GetMessagePos
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
GetCapture
GetScrollRange
SetScrollRange
SetScrollPos
InflateRect
PtInRect
OffsetRect
RedrawWindow
SetActiveWindow
SetCursorPos
InvertRect
IsRectEmpty
IsChild
EqualRect
LockWindowUpdate
GetTopWindow
MessageBeep
wsprintfA
SetMenuDefaultItem
SetMenuItemBitmaps
SetMenuItemInfoW
CheckMenuItem
RemoveMenu
MenuItemFromPoint
GetMenuDefaultItem
GetMenuState
GetMenuItemRect
GetMenuItemInfoW
GetMenuStringW
CheckMenuRadioItem
GetMenuItemID
GetSubMenu
GetWindowTextLengthA
InsertMenuW
GetMenuItemCount
AppendMenuW
LoadMenuW
GetSystemMenu
CreateMenu
CharLowerW
CharUpperW
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageW
DrawMenuBar
SetMenu
GetMenu
GetSystemMetrics
IsZoomed
IsIconic
GetSysColor
PostQuitMessage
DestroyIcon
SetTimer
KillTimer
SetClassLongW
GetClassLongW
SetRect
DestroyCursor
RemovePropW
GetPropW
SetPropW
MessageBoxW
EnableWindow
IsWindowEnabled
PostMessageW
ValidateRect
GetDlgItem
SendMessageW
TrackMouseEvent
SetCursor
LoadCursorW
DefMDIChildProcW
GetAsyncKeyState
ReleaseDC
GetDC
DefWindowProcW
FillRect
RegisterClassExW
LoadCursorA
DestroyWindow
GetWindow
ShowWindow
BringWindowToTop
CreateWindowExW
UpdateWindow
InvalidateRect
SetWindowRgn
AppendMenuA
DestroyMenu
TrackPopupMenu
CreatePopupMenu
GetCursorPos
SetWindowTextW
RemovePropA
MoveWindow
SetParent
DefWindowProcA
ScreenToClient
ReleaseCapture
SetCapture
SetFocus
GetFocus
EndPaint
IntersectRect
BeginPaint
CallWindowProcW
SetWindowTextA
SetWindowLongW
GetWindowLongW
WaitForInputIdle
IsClipboardFormatAvailable
GetForegroundWindow
GetWindowRect
ClientToScreen
GetScrollPos
SendMessageTimeoutW
CallWindowProcA
SetPropA
GetPropA
GetParent
IsWindowVisible
GetClassNameW
EnumWindows
PostThreadMessageA
GetWindowLongA
MsgWaitForMultipleObjects
PeekMessageA
ShowWindowAsync
SetWindowPos
GetClipboardFormatNameA
GetClipboardData
EnumClipboardFormats
MapVirtualKeyA
GetGUIThreadInfo
SetKeyboardState
GetKeyboardState
AttachThreadInput
GetWindowThreadProcessId
PostMessageA
GetClientRect
CloseClipboard
SetClipboardData
EmptyClipboard
IsWindow
OpenClipboard
RegisterClipboardFormatA
GetWindowTextW
GetWindowTextLengthW
FindWindowExA
CallNextHookEx
DispatchMessageW
TranslateMessage
SetWindowsHookExW
SetForegroundWindow
OpenIcon
GetAncestor
GetActiveWindow
MessageBoxA
SetWindowLongA
SendMessageA
DrawTextW
GetDoubleClickTime
ClipCursor
GetMenuStringA
GetTabbedTextExtentA
GrayStringA
TabbedTextOutA
WindowFromDC
EnumChildWindows
GetWindowDC
DrawTextA
GetCursor
CreateWindowExA
SetMenuInfo
GetClassInfoExW
UnregisterClassA

gdi32

GetPixel
StartPage
StartDocA
EndDoc
EndPage
CreateFontIndirectA
PatBlt
CreatePen
CreateBitmap
CreateBrushIndirect
FillRgn
CreateDCA
GetPolyFillMode
SetWindowOrgEx
SaveDC
RestoreDC
CreatePenIndirect
PtVisible
RectVisible
Escape
AbortDoc
SetBrushOrgEx
MoveToEx
GetTextMetricsW
SetBitmapBits
TranslateCharsetInfo
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExcludeClipRect
SetPixelV
Ellipse
ExtSelectClipRgn
GetViewportExtEx
GetMapMode
CopyMetaFileA
CreateFontA
GetBitmapBits
SetDIBitsToDevice
TextOutA
CreateRectRgnIndirect
SetPixel
GetClipRgn
CreatePolygonRgn
SelectClipRgn
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
SelectPalette
RealizePalette
GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
GetTextColor
LineTo
GetTextExtentPoint32A
GetDeviceCaps
CreatePatternBrush
SetBkMode
SetTextColor
ExtCreateRegion
CreateDIBSection
GetObjectA
CreateSolidBrush
ExtTextOutA
SetBkColor
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
CreateCompatibleDC
CombineRgn
CreateRectRgn
GetStockObject
DeleteDC
GetTextMetricsA
OffsetRgn
FrameRgn
Rectangle
SelectObject
LPtoDP
DPtoLP
GetCurrentObject
DeleteObject
RoundRect
CreateRoundRectRgn
GetTextExtentPoint32W
BitBlt
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode

msimg32

GradientFill
AlphaBlend

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

ChooseColorA
GetFileTitleA
PrintDlgA
GetSaveFileNameA
GetOpenFileNameA
ChooseFontA

advapi32

RegCreateKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegOpenKeyA
CreateProcessAsUserA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA

shell32

DragFinish
DragQueryFileA
DragQueryFileW
Shell_NotifyIconW
StrRStrW
ShellExecuteA
Shell_NotifyIconA
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderPathA
DragAcceptFiles
ShellExecuteEx

ole32

CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleDuplicateData
CoRegisterMessageFilter
CoLockObjectExternal
DoDragDrop
OleGetClipboard
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoTaskMemFree
ReleaseStgMedium
CLSIDFromProgID
OleInitialize
OleUninitialize
CoCreateInstance
OleRun
GetHGlobalFromStream
CreateStreamOnHGlobal
CLSIDFromString
RevokeDragDrop
StringFromGUID2
CoUninitialize
CoInitialize
CoRevokeClassObject
CoTaskMemAlloc

oleaut32

VariantInit
VariantCopyInd
SafeArrayGetElement
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
VariantCopy
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
SafeArrayDestroy
SafeArrayCreate
OleCreatePictureIndirect
SafeArrayPutElement
UnRegisterTypeLi
SysFreeString
SafeArrayGetElemsize
SysAllocStringByteLen
VarDateFromStr
SysAllocStringLen
SysStringLen
RegisterTypeLi
LHashValOfNameSys
OleCreateFontIndirect
LoadTypeLi

imagehlp

MakeSureDirectoryPathExists

atl

ord42

comctl32

ImageList_DragLeave
ImageList_DragEnter
ImageList_Destroy
ImageList_Create
ImageList_BeginDrag
ImageList_Add
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetBkColor
ImageList_Draw
ImageList_GetImageCount
ImageList_GetIcon
ImageList_AddMasked
InitCommonControlsEx
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_Write
ImageList_Read
ord17
ImageList_EndDrag

wininet

InternetTimeFromSystemTime

oledlg

ord8

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.6MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sedata
Size: 336KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3b640379969e55b268ebf159ba5d5903

Headers

File Characteristics

Imports

msvfw32

avifil32

iphlpapi

shlwapi

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

imagehlp

atl

comctl32

wininet

oledlg

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.rdata Size: 8.6MB - Virtual size: 8.6MB

.data Size: 156KB - Virtual size: 564KB

.rsrc Size: 52KB - Virtual size: 52KB

.sedata Size: 336KB - Virtual size: 336KB

.idata Size: 16KB - Virtual size: 16KB

.text
Size: 5.2MB - Virtual size: 5.2MB

.rdata
Size: 8.6MB - Virtual size: 8.6MB

.data
Size: 156KB - Virtual size: 564KB

.rsrc
Size: 52KB - Virtual size: 52KB

.sedata
Size: 336KB - Virtual size: 336KB

.idata
Size: 16KB - Virtual size: 16KB