blackmoon | f094c7cb70d087c881201a87435d87a0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f094c7cb70d087c881201a87435d87a0_JaffaCakes118
Size

180KB
MD5

f094c7cb70d087c881201a87435d87a0
SHA1

2b8a69e3b855431a3c19720d3f7a537b139961cf
SHA256

0e70e8d8295b04d5035674d1e4f4f7a083e6462a058b20e5a0544542fda270ae
SHA512

e3b03bd8bddb4a54e1e2171fa362ca6ce5cd24b6da5e3dd859b378316b09ba749e43dd04f9a49b68f5250e2c7cdfb17eb0b86d81efbc2bca41d39d90466a9fb8
SSDEEP

1536:nw3hwXf+I2jb3kBdDfmciQl3O4RUssAfRv7ti2Jcs84+CWD3uO+Uj:neDb3kBxfl3O4RUM7tiS/BO+Uj

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f094c7cb70d087c881201a87435d87a0_JaffaCakes118

Files

f094c7cb70d087c881201a87435d87a0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c4dd2f275007ed5e6a59fe580601b332

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
memmove
modf
strrchr
strncpy
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
_ftol
rand
srand

kernel32

DeleteCriticalSection
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
LocalSize
RtlMoveMemory
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
WaitForSingleObject
CloseHandle
GetEnvironmentVariableA
TerminateProcess
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
CreateDirectoryA
WriteFile
CreateFileA
WritePrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
SetFileAttributesA
GetStartupInfoA
GetCommandLineA
GetModuleFileNameA
CreateThread
lstrcpyn
GetTickCount

user32

MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoInitialize

wininet

InternetOpenA
InternetReadFile
InternetOpenUrlA
InternetGetConnectedState

ntdll

ZwUnmapViewOfSection

oleaut32

SafeArrayGetElement
VariantChangeType
SafeArrayGetDim
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
RegisterTypeLi
LoadTypeLi
VarR8FromBool
VarR8FromCy
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantInit
SafeArrayGetUBound

shlwapi

PathFileExistsA

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c4dd2f275007ed5e6a59fe580601b332

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

shell32

ole32

wininet

ntdll

oleaut32

shlwapi

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 132KB - Virtual size: 203KB

.rsrc Size: 4KB - Virtual size: 16B

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 132KB - Virtual size: 203KB

.rsrc
Size: 4KB - Virtual size: 16B