blackmoon | fc98a94e3a1bd54384392091ca7e262b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fc98a94e3a1bd54384392091ca7e262b_JaffaCakes118
Size

1.1MB
MD5

fc98a94e3a1bd54384392091ca7e262b
SHA1

6feacfb8b47ac1bbeb002bbc62f1da3799b4d46c
SHA256

8c2611f4f8ef2101ed2c9983f72d13dc2da60949574f835886518df013174a6a
SHA512

0ed9c8838923a9fc156cd5b896177622398f0ff96359d1808f62e25dcc917e1b8aaed1fd005542252f1348f58d3415b240579b4c09cd0336f443d1560d0a258f
SSDEEP

12288:lIcr3Bw8MSQQm5YU+h30vB5Qh4TE+dXRcqa+bTWd4CvIvkM9K:l/jBwVSzmnv8h4TE+dXRcqDbT2fvcvI

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc98a94e3a1bd54384392091ca7e262b_JaffaCakes118

Files

fc98a94e3a1bd54384392091ca7e262b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

df234945d14daf52f631431a6ac182a2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
FormatMessageA
GetUserDefaultLCID
CreateFileA
GetFileSize
ReadFile
MoveFileA
CopyFileA
DeleteFileA
GetTickCount
GetStartupInfoA
CreateProcessA
WaitForSingleObject
GetModuleFileNameA
GetCommandLineA
IsBadReadPtr
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
LocalSize
GlobalSize
RtlMoveMemory
lstrlenW
CreateWaitableTimerA
CloseHandle
SetWaitableTimer
CreateWaitableTimerW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
VirtualFree
VirtualAlloc
Module32First
CreateToolhelp32Snapshot
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
LCMapStringW
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetACP
HeapSize
RaiseException
GetLocalTime
GetSystemTime
GetTimeZoneInformation
LoadLibraryA
ExitThread
CreateThread
RtlUnwind
GetOEMCP
GetCPInfo
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
GetCurrentProcess
SetErrorMode
GetProcessVersion
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
SetLastError
InterlockedIncrement
lstrcpyA
lstrcatA
WritePrivateProfileStringA
InterlockedDecrement
GlobalFlags
MulDiv
lstrcpynA
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrlenA
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
UnmapViewOfFile
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TerminateThread
LocalFree
CreateFileMappingA
MapViewOfFile
GetCurrentThreadId
LCMapStringA
TerminateProcess
GetCurrentProcessId
CreateEventA
OpenEventA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
MultiByteToWideChar
GetNativeSystemInfo
GetProcAddress
GetModuleHandleW
GetProcessHeap
Sleep
GetLastError

user32

LoadCursorW
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
RegisterClassExW
DefWindowProcW
SystemParametersInfoA
MessageBoxA
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextA
GetClassNameA
IsIconic
OpenIcon
CopyImage
MsgWaitForMultipleObjects
CreateWindowExW
SendMessageW
GetClassNameW
PostMessageW
IsWindow
GetMessageW
SetForegroundWindow
TranslateMessage
DispatchMessageW
EnableWindow
SetCursor
SendMessageA
KillTimer
GetAsyncKeyState
IntersectRect
InvalidateRect
UpdateLayeredWindow
ReleaseCapture
IsZoomed
GetPropA
LoadCursorFromFileW
SetTimer
PtInRect
ReleaseDC
SetCaretPos
GetCursorPos
GetWindowRect
CallWindowProcW
TrackMouseEvent
ShowWindow
BeginPaint
EndPaint
SetCapture
GetSystemMetrics
MoveWindow
PostMessageA
GetFocus
SetFocus
SetWindowLongW
SetWindowPos
SetPropA
GetClassLongW
GetParent
SetWindowRgn
GetWindowTextW
RemovePropA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
EndDialog
CreateDialogIndirectParamA
DestroyMenu
PostThreadMessageA
UnregisterClassA
LoadStringA
GetSysColorBrush
LoadCursorA
LoadIconA
UpdateWindow
MapWindowPoints
PostQuitMessage
GetWindowLongA
IsWindowEnabled
GetLastActivePopup
SetWindowsHookExA
ValidateRect
CallNextHookEx
GetKeyState
GetActiveWindow
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
GetDlgCtrlID
GetWindow
ClientToScreen
SetWindowTextA
UnhookWindowsHookEx
GetMenuItemCount
GetDC
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
SendDlgItemMessageA
IsDialogMessageA
SetWindowLongA
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
SetActiveWindow
GetSysColor

gdi32

GetObjectA
GetDIBits
CreateRectRgn
CreateRoundRectRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateBitmap
SaveDC
GetStockObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
RestoreDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps

gdiplus

GdipDeleteRegion
GdipSetClipRect
GdipDrawRectangle
GdipDeletePen
GdipSetPenDashStyle
GdipCreateFromHDC
GdipGetSmoothingMode
GdipGetImagePixelFormat
GdipCloneBitmapArea
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageRect
GdipCreateStringFormat
GdipSetStringFormatHotkeyPrefix
GdipCreateLineBrushFromRect
GdipFillRectangle
GdipMeasureString
GdipGetFontHeight
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipGetStringFormatAlign
GdipGetStringFormatTrimming
GdipGetStringFormatFlags
GdipImageSelectActiveFrame
GdipDeleteStringFormat
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSetStringFormatMeasurableCharacterRanges
GdipCreateRegion
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipCreateRegionHrgn
GdipDrawPath
GdipDeletePath
GdipCreatePath
GdipAddPathArc
GdipClosePathFigure
GdipFillPath
GdipCreateLineBrush
GdipCreatePen2
GdipFillPolygon
GdipDrawPolygon
GdipCreatePathGradientFromPath
GdipGetCompositingQuality
GdipCreateHBITMAPFromBitmap
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDeleteBrush
GdipDrawString
GdipCreateSolidFill
GdipSetStringFormatAlign
GdipSetClipRegion
GdipCreateRegionRect
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRect
GdipLoadImageFromStream
GdipGraphicsClear
GdipResetClip
GdipGetFontStyle
GdipGetFontSize
GdipGetFamilyName
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateImageAttributes
GdipImageGetFrameCount
GdiplusStartup

ole32

CoInitialize
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromProgID
CreateStreamOnHGlobal
CLSIDFromString
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
StringFromGUID2

oleaut32

OleLoadPicture
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi

shell32

Shell_NotifyIconW
ShellExecuteA

shlwapi

PathFindExtensionA
PathFileExistsA
PathFindFileNameA

imm32

ImmGetContext
ImmAssociateContext

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

oledlg

ord8

ws2_32

gethostbyname
inet_ntoa
send
recv
select
__WSAFDIsSet
ntohs
connect
closesocket
WSAStartup
socket
ioctlsocket
WSAGetLastError
htons
bind
getsockname
gethostname
inet_addr
accept
listen

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

comctl32

ord17

Sections

.text
Size: 644KB - Virtual size: 640KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 364KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df234945d14daf52f631431a6ac182a2

Headers

File Characteristics

Imports

kernel32

user32

gdi32

gdiplus

ole32

oleaut32

shell32

shlwapi

imm32

advapi32

oledlg

ws2_32

winspool.drv

comctl32

Sections

.text Size: 644KB - Virtual size: 640KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 364KB - Virtual size: 433KB

.rsrc Size: 100KB - Virtual size: 98KB

.text
Size: 644KB - Virtual size: 640KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 364KB - Virtual size: 433KB

.rsrc
Size: 100KB - Virtual size: 98KB