blackmoon | fe12e7b14cfeaf632982b005650ff936428c02fed07b2cf3d09189323fc3c779

Sharing

Copy URL Twitter E-mail

General

Target

fe12e7b14cfeaf632982b005650ff936428c02fed07b2cf3d09189323fc3c779
Size

1.1MB
MD5

421f15da4b8aa8209b3df95257aa96cc
SHA1

53e076178fca3511f7e310d829e055120e3750ad
SHA256

fe12e7b14cfeaf632982b005650ff936428c02fed07b2cf3d09189323fc3c779
SHA512

4d4ea00d82a06b22bc0b366b6be91c415ee2f19e0f9a0c079ba254ae4b1e79fe6c6ac9dd8d39c5ed90b15e096141a2fb9485b8bdc2f76dcbb99d9128d78eafa2
SSDEEP

12288:R6hsUoWy3KKixd6lT8X96uEDr37fO+Va//zGN1fw4iiFfPd9thXPDQ:R6B2KK9At6uETffV8KrfFP7f

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe12e7b14cfeaf632982b005650ff936428c02fed07b2cf3d09189323fc3c779

Files

fe12e7b14cfeaf632982b005650ff936428c02fed07b2cf3d09189323fc3c779
.dll windows:4 windows x86 arch:x86

ce505b40c9cbb12258a17562fae8db4e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
WriteFile
SetFilePointer
CreateFileA
GetLastError
GetCurrentProcess
GetVersionExA
GetDriveTypeA
TerminateProcess
GetWindowsDirectoryA
lstrcpyA
lstrlenA
SetLastError
ReadFile
LockResource
LoadResource
FindResourceA
GetTimeZoneInformation
GetLocaleInfoA
GetVersion
WaitForSingleObject
SetNamedPipeHandleState
WaitNamedPipeA
UnmapViewOfFile
SetEvent
MapViewOfFile
OpenFileMappingA
OpenEventA
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
InterlockedIncrement
CreateSemaphoreA
InterlockedDecrement
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
MulDiv
LocalFree
FlushFileBuffers
SetEndOfFile
lstrcpynA
GetFullPathNameA
LocalAlloc
GlobalHandle
GlobalReAlloc
LocalReAlloc
SetErrorMode
GlobalFlags
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
LCMapStringW
SetUnhandledExceptionFilter
SetEnvironmentVariableW
SetEnvironmentVariableA
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
SetStdHandle
IsBadCodePtr
CompareStringA
CompareStringW
GetLocaleInfoW
InterlockedExchange
Sleep
TerminateThread
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LCMapStringA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCommandLineA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetUserDefaultLCID
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
lstrcatA
CreateThread

user32

CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
RegisterClipboardFormatA
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
UnhookWindowsHookEx
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
EndDialog
UnregisterClassA
GetDlgCtrlID
SetWindowTextA
GetMenuItemCount
SendDlgItemMessageA
IsDialogMessageA
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
RegisterWindowMessageA
GetForegroundWindow
EnableMenuItem
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CallNextHookEx
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
PostThreadMessageA
DestroyMenu
GetParent
GetWindow
GetSystemMetrics
PtInRect
IsWindowVisible
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetMessagePos
GetKeyState
ValidateRect
SetWindowsHookExA
GetLastActivePopup
IsWindowEnabled
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
EnableWindow
SetCursor
GetWindowLongA
GetWindowTextA
GetCursorPos
SetWindowLongA
GetDlgItem
ShowWindow
UpdateWindow
SystemParametersInfoA
GetDC
ReleaseDC
GetClassNameA
IsWindow
SendMessageA
GetWindowRect
PostMessageA
PostQuitMessage
MessageBoxA
MsgWaitForMultipleObjects
SetForegroundWindow

gdi32

GetStockObject
GetObjectA
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
SelectObject
DeleteDC
DeleteObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegEnumValueA
RegCreateKeyExA

ole32

CLSIDFromProgID
CLSIDFromString
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
OleRun
OleFlushClipboard
OleIsCurrentClipboard
CoUninitialize
CoRevokeClassObject
CoInitialize
CoCreateInstance

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetReadFile
HttpQueryInfoA

oledlg

ord8

oleaut32

VariantTimeToSystemTime
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim

ws2_32

recv
gethostbyname
inet_addr
connect
ioctlsocket
WSAGetLastError
WSACleanup
WSAStartup
socket
htons
closesocket
select
__WSAFDIsSet
send
getpeername
shutdown
inet_ntoa
setsockopt
getservbyname
ntohs

iphlpapi

GetAdaptersInfo

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

comctl32

ord17

Exports

Exports

ServiceMain

Sections

.text
Size: 304KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 724KB - Virtual size: 879KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce505b40c9cbb12258a17562fae8db4e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

wininet

oledlg

oleaut32

ws2_32

iphlpapi

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 302KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 724KB - Virtual size: 879KB

.rsrc Size: 4KB - Virtual size: 664B

.reloc Size: 40KB - Virtual size: 38KB

.text
Size: 304KB - Virtual size: 302KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 724KB - Virtual size: 879KB

.rsrc
Size: 4KB - Virtual size: 664B

.reloc
Size: 40KB - Virtual size: 38KB