blackmoon | fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118
Size

1.1MB
MD5

fdd9d2f7b6fe2f76a4b676d1a4bb3729
SHA1

1f8a57e6e88774195c0e0f2973e49683e0dd45e2
SHA256

47f8d217e1cb7721b9e57f290ddd7c93f448ef4b60d3b2957829823c984847a9
SHA512

fcd27ead29837d86cf1f58cb150f54d4eecf85bf7f6f9fab61262db63309a39b2fc96ddeece056f73b5d070623532b8e01d3cd497dda5b47250f44e9129daab7
SSDEEP

24576:UBNYbDi9XFNMae8gQF4cxf7qO9Tw4164by09AidwQ:GaCWaResJ6i

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118

Files

fdd9d2f7b6fe2f76a4b676d1a4bb3729_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0cffac1f08672340726cb462e0336118

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
VirtualFreeEx
LCMapStringA
SetEndOfFile
GetFileSize
ReadFile
SetFilePointer
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
GetModuleFileNameA
Sleep
UnmapViewOfFile
GetStartupInfoA
CreateDirectoryA
GetEnvironmentVariableA
CreateFileA
WriteFile
IsBadReadPtr
HeapReAlloc
ExitProcess
GetProcessHeap
GetTickCount
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetLastError
HeapFree
HeapDestroy
HeapAlloc
CreateIoCompletionPort
HeapCreate
MapViewOfFile
CreateFileMappingA
VirtualAllocEx
VirtualQueryEx
CreateProcessA
TerminateProcess
GetCurrentProcess
RtlMoveMemory
lstrcpyn
LocalSize
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
SetProcessWorkingSetSize
TerminateThread
GetExitCodeThread
LeaveCriticalSection
EnterCriticalSection
SetProcessAffinityMask
CreateThread
InitializeCriticalSection
OpenProcess
GetSystemDirectoryA
Process32Next
CloseHandle
ResumeThread
SuspendThread
WaitForSingleObject
CreateRemoteThread
GetProcAddress
WriteProcessMemory
ReadProcessMemory
GetLocalTime
Process32First
CreateToolhelp32Snapshot
CreateEventA
GetCommandLineA
OpenEventA
UnhandledExceptionFilter
QueryPerformanceFrequency
QueryPerformanceCounter
DeviceIoControl
GetSystemDefaultLangID
GetLocaleInfoA
GlobalSize
SizeofResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
DeleteFileA
FindNextFileA
RemoveDirectoryA
SetFileAttributesA
GetDriveTypeA
InterlockedExchange
Module32Next
Module32First
GlobalMemoryStatus
CopyFileA
EnumResourceNamesA
GetProfileStringA
WriteProfileStringA
WinExec
GetLocaleInfoW
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetCurrentDirectoryA
MulDiv
VerLanguageNameA
FileTimeToSystemTime
GetTimeZoneInformation
SetLastError
InterlockedIncrement
InterlockedDecrement
LocalFree
lstrcpynA
lstrcpyA
FreeLibrary
LocalAlloc
LoadLibraryA
DeleteCriticalSection
FileTimeToLocalFileTime
DuplicateHandle
FlushFileBuffers
LockFile
UnlockFile
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
lstrcmpiA
GetFileAttributesA
GetFileTime
lstrlenA
GetTempPathA
GetWindowsDirectoryA
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
lstrcatA
GetVersion
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GlobalFlags
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
GetSystemTime
GetACP
HeapSize
SetStdHandle
GetFileType
LCMapStringW
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
VirtualFree
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GetCurrentThreadId
lstrcmpA

user32

RegisterWindowMessageA
EnableWindow
IsWindowEnabled
GetForegroundWindow
IsWindow
GetActiveWindow
SetActiveWindow
SetForegroundWindow
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
PtInRect
GetSysColorBrush
PostQuitMessage
DestroyMenu
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
MapWindowPoints
GetFocus
SetFocus
AdjustWindowRectEx
GetClientRect
GetTopWindow
GetCapture
SetTimer
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetMessagePos
GetWindow
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetLastActivePopup
GetWindowLongA
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
CopyRect
GetKeyState
CallNextHookEx
SetWindowsHookExA
GetSystemMetrics
CharUpperA
SetWindowTextA
GetMessageTime
IsDialogMessageA
IsWindowVisible
EnumWindows
IsRectEmpty
ShowWindow
UpdateWindow
ChangeDisplaySettingsA
EnumDisplaySettingsA
SetCursorPos
mouse_event
keybd_event
GetDesktopWindow
ReleaseCapture
SendMessageA
LoadImageA
VkKeyScanExA
GetKeyboardLayout
SendDlgItemMessageA
EndDialog
CreateDialogIndirectParamA
GetKeyboardState
SendMessageTimeoutA
GetInputState
PeekMessageA
DispatchMessageA
TranslateMessage
KillTimer
FindWindowExA
FindWindowA
GetWindowTextA
GetClassInfoExA
RegisterClassExA
LoadIconA
LoadCursorA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetMessageA
wsprintfA
MessageBoxA
GetGUIThreadInfo
GetWindowThreadProcessId
GetWindowRect
CallWindowProcA
ReleaseDC
WindowFromPoint
GetCursorPos
GetAncestor
LoadStringA
PostMessageA
GetParent
InvalidateRect
EndPaint
WinHelpA
SetCapture
MoveWindow
FillRect
GetSysColor
GetDC
DefWindowProcA
TrackMouseEvent
BeginPaint

advapi32

RegCloseKey
InitializeSecurityDescriptor
RegQueryValueExA
RegOpenKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegSetKeySecurity
RegOpenKeyExA
CopySid
GetLengthSid
GetTokenInformation
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetSidSubAuthorityCount
GetSidIdentifierAuthority
AddAce
InitializeAcl
FreeSid
AllocateAndInitializeSid
RegGetKeySecurity
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
SetSecurityDescriptorDacl

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CoCreateGuid

gdi32

CreateSolidBrush
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetObjectA
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
DeleteObject
SetBkColor
SetTextColor
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SaveDC
EnumFontFamiliesExA
AddFontResourceA
RemoveFontResourceA
GetPixel
CreateCompatibleBitmap
CreateDCA
GetDIBits
RealizePalette
SelectPalette
GetClipBox
RestoreDC

wsock32

select
gethostname
WSACleanup
gethostbyaddr
sendto
recv
send
WSAStartup
gethostbyname
WSASetLastError
socket
setsockopt
ntohs
ioctlsocket
connect
htons
inet_addr
ord1142
ord1141
ord1140
closesocket
listen
bind

wininet

InternetReadFile
InternetCrackUrlA
FtpFindFirstFileA
InternetFindNextFileA
FtpGetFileA
FtpPutFileA
FtpGetCurrentDirectoryA
HttpSendRequestA
InternetSetCookieA
InternetQueryOptionA
FindCloseUrlCache
DeleteUrlCacheEntryA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
HttpQueryInfoA
InternetGetConnectedState
DeleteUrlCacheEntry
InternetOpenUrlA
FtpDeleteFileA
FtpRenameFileA
FtpCreateDirectoryA
InternetCanonicalizeUrlA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA

ws2_32

WSASocketA
WSARecv
WSASend

oleaut32

VariantChangeType
VariantInit
SafeArrayGetElement
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy

psapi

GetModuleFileNameExA

oleacc

ObjectFromLresult

iphlpapi

GetAdaptersInfo
SendARP

shell32

ShellExecuteA
SHGetSpecialFolderPathA
SHEmptyRecycleBinA
SHChangeNotify

comdlg32

PrintDlgA
GetFileTitleA

winspool.drv

GetPrinterA
SetPrinterA
ClosePrinter
EnumPrintersA
DocumentPropertiesA
OpenPrinterA

comctl32

ord17

rasapi32

RasEnumConnectionsA
RasHangUpA
RasDialA
RasEnumEntriesA
RasGetEntryDialParamsA
RasGetConnectStatusA

shlwapi

SHDeleteValueA
PathFileExistsA
PathAppendA
SHDeleteKeyA

mpr

WNetAddConnection2A
WNetOpenEnumA
WNetEnumResourceA
WNetCancelConnection2A
WNetCloseEnum

winmm

waveOutGetNumDevs
waveOutGetDevCapsA
mciSendStringA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 688KB - Virtual size: 685KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 392KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0cffac1f08672340726cb462e0336118

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

gdi32

wsock32

wininet

ws2_32

oleaut32

psapi

oleacc

iphlpapi

shell32

comdlg32

winspool.drv

comctl32

rasapi32

shlwapi

mpr

winmm

version

Sections

.text Size: 688KB - Virtual size: 685KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 392KB - Virtual size: 483KB

.text
Size: 688KB - Virtual size: 685KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 392KB - Virtual size: 483KB