blackmoon | 46113fa5011e35c873e7740aaf93009036e36f2219595db0d9bdd396dad988e8N

Sharing

Copy URL Twitter E-mail

General

Target

46113fa5011e35c873e7740aaf93009036e36f2219595db0d9bdd396dad988e8N
Size

1.4MB
MD5

712b04c9f4d51e2eaa390350a370c690
SHA1

1ed6b480d8c9cf3a414e6540ec6d4edd6d70e162
SHA256

46113fa5011e35c873e7740aaf93009036e36f2219595db0d9bdd396dad988e8
SHA512

77a0cb280c1be1b4c09237bffc4fb9014e6e8586c620e519e08b5ca78e19cf32684fc70a0ca4827089fc796a63d90a6fceb61ebf2935ecaffb56338051e05857
SSDEEP

24576:WtTac2nu7kw59yVTJLJyxXJKmfbs5PtDdnK7loZhRh/HNwQ:Ww5FRnKBwh/

Score

10^/10

blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
sample	family_blackmoon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46113fa5011e35c873e7740aaf93009036e36f2219595db0d9bdd396dad988e8N

Files

46113fa5011e35c873e7740aaf93009036e36f2219595db0d9bdd396dad988e8N
.exe windows:4 windows x86 arch:x86

ee683f7bdf39e401d4f1b56beebbff29

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteValueA
PathIsDirectoryA
PathFileExistsA
SHDeleteKeyA
PathAppendA

ws2_32

gethostbyaddr
inet_addr
gethostname
inet_ntoa
closesocket
htons
sendto
WSACleanup
gethostbyname
ntohs
socket
WSAStartup
WSCEnumProtocols
connect

kernel32

GlobalReAlloc
LCMapStringA
LoadLibraryA
FreeLibrary
GetModuleFileNameA
GetCommandLineA
Sleep
GetUserDefaultLCID
WritePrivateProfileStringA
CreateDirectoryA
FindClose
FindFirstFileA
FindNextFileA
GetCurrentDirectoryA
GetDiskFreeSpaceExA
GetPrivateProfileStringA
GetTickCount
DeleteFileA
CreateFileA
GetFileSize
ReadFile
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
GetLastError
CreateFileMappingA
VirtualProtect
GetExitCodeThread
WaitForSingleObject
VirtualProtectEx
VirtualFreeEx
InitializeCriticalSection
RtlMoveMemory
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
TerminateProcess
SetWaitableTimer
CreateWaitableTimerA
GetCurrentThreadId
CreateRemoteThread
Module32Next
GetProcAddress
GetModuleHandleA
Process32Next
Process32First
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GlobalHandle
TlsAlloc
GetProcessVersion
LocalAlloc
GetFileTime
WriteProcessMemory
lstrcpyn
ReadProcessMemory
VirtualQueryEx
OpenProcess
CreateThread
CloseHandle
GetCurrentProcess
VirtualFree
VirtualAlloc
MultiByteToWideChar
GetModuleHandleW
GetTempPathA
GetSystemDirectoryA
GetTempFileNameA
WideCharToMultiByte
VirtualAllocEx
CopyFileA
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
UnhandledExceptionFilter
GetCurrentThread
TlsFree
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersion
lstrlenA
DeviceIoControl
GetTimeZoneInformation
GetSystemDefaultLangID
GetLocaleInfoA
SetFilePointer
WriteFile
GlobalSize
lstrcpyA
SizeofResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
RemoveDirectoryA
SetFileAttributesA
GetFileAttributesA
GetVolumeInformationA
GetDriveTypeA
InterlockedExchange
GlobalMemoryStatus
GetWindowsDirectoryA
EnumResourceNamesA
GetProfileStringA
SetLastError
WriteProfileStringA
lstrcatA
WinExec
InterlockedIncrement
InterlockedDecrement
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetStdHandle
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
IsBadCodePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GlobalFlags
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FlushFileBuffers
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
IsBadWritePtr
GetFullPathNameA
lstrcpynA
SetEndOfFile
UnlockFile
LockFile
DuplicateHandle
MulDiv
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
VerLanguageNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
GetSystemTime
GetLocalTime
HeapSize
GetACP
GetStringTypeA
GetStringTypeW
LCMapStringW
GetEnvironmentVariableA
HeapDestroy
HeapCreate

user32

RegisterWindowMessageA
LoadIconW
RegisterClassExW
DefWindowProcW
CreateWindowExW
SendMessageW
ShowWindow
UpdateWindow
SystemParametersInfoA
GetClassLongA
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
PostQuitMessage
PostThreadMessageA
PostMessageA
IsWindow
GetForegroundWindow
GetWindowThreadProcessId
GetClientRect
EnumChildWindows
GetDesktopWindow
GetWindow
GetClassNameA
GetWindowTextA
MsgWaitForMultipleObjects
LoadCursorW
CallWindowProcA
ReleaseCapture
CallWindowProcW
SetCursor
BeginPaint
EndPaint
GetWindowRect
GetPropW
ReleaseDC
GetWindowLongW
SetWindowLongW
UpdateLayeredWindow
TrackMouseEvent
SendMessageA
KillTimer
DestroyWindow
RemovePropW
IsZoomed
PostMessageW
SetCapture
GetFocus
SetFocus
SetPropW
GetDC
SetWindowPos
GetWindowTextW
IsRectEmpty
SetTimer
SetWindowRgn
RedrawWindow
GetIconInfo
CreateCaret
DestroyCaret
GetKeyState
SetCaretPos
LoadIconA
SetWindowLongA
CreateIconFromResource
SetForegroundWindow
GetCursorPos
IsIconic
DestroyIcon
GetParent
MessageBoxA
wsprintfA
DispatchMessageA
GetMessageA
PeekMessageA
CloseClipboard
GetClipboardData
OpenClipboard
SetClipboardData
EmptyClipboard
IsDialogMessageA
GetWindowPlacement
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
CreateWindowExA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadCursorA
GetSysColorBrush
DestroyMenu
CharUpperA
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetNextDlgTabItem
GetActiveWindow
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
IsWindowEnabled
EnableWindow
WindowFromPoint
PtInRect
GetWindowLongA
EnumWindows
FindWindowExA
GetDlgItem
ChangeDisplaySettingsA
EnumDisplaySettingsA
SendMessageTimeoutA
FindWindowA
SetCursorPos
mouse_event
keybd_event
GetSystemMetrics
LoadImageA
VkKeyScanExA
GetKeyboardLayout
SendDlgItemMessageA
GetMenuItemCount
SetWindowTextA
GetDlgCtrlID
LoadStringA
UnregisterClassA
EndDialog
SetActiveWindow
CreateDialogIndirectParamA
LoadBitmapA
GetKeyboardState
ValidateRect
RegisterClipboardFormatA

gdi32

GetDIBits
GetObjectW
CreateRoundRectRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
BitBlt
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
PtVisible
RectVisible
TextOutA
ExtTextOutA
GetTextExtentPoint32W
GetObjectA
GetStockObject
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
SelectPalette
RealizePalette
CreateDCA
CreateCompatibleBitmap
GetPixel
GetDeviceCaps
RemoveFontResourceA
AddFontResourceA
EnumFontFamiliesExA
Escape

advapi32

RegCloseKey
InitializeSecurityDescriptor
RegQueryValueExA
RegOpenKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegSetKeySecurity
RegOpenKeyExA
CopySid
GetLengthSid
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
AddAce
InitializeAcl
FreeSid
AllocateAndInitializeSid
RegGetKeySecurity
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
SetSecurityDescriptorDacl
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA

shell32

SHGetSpecialFolderLocation
Shell_NotifyIconW
SHGetPathFromIDListA
Shell_NotifyIconA
SHGetSpecialFolderPathA
SHEmptyRecycleBinA
SHChangeNotify
ShellExecuteA

comctl32

ord17
ImageList_GetIcon
ImageList_GetIconSize

ole32

CoCreateGuid
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
OleRun
CLSIDFromString
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID

gdiplus

GdipDrawRectangle
GdipDeletePen
GdipSetPenDashStyle
GdipDrawPath
GdipDeletePath
GdipCreatePath
GdipAddPathArc
GdipClosePathFigure
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateBitmapFromHICON
GdipSetInterpolationMode
GdipCloneBitmapArea
GdipCreateSolidFill
GdipImageSelectActiveFrame
GdipDeleteStringFormat
GdipMeasureString
GdipGetFontHeight
GdipGetFontSize
GdipGetFontStyle
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipGetStringFormatAlign
GdipSetStringFormatAlign
GdipBitmapGetPixel
GdipDrawString
GdipSetCompositingQuality
GdipSetClipPath
GdipFillPath
GdipSetStringFormatMeasurableCharacterRanges
GdipCreateRegion
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipGetImagePixelFormat
GdipCombineRegionRect
GdipDeleteBrush
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipCreateRegionHrgn
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipDeleteRegion
GdipResetClip
GdipDisposeImageAttributes
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipCreateMatrix
GdipGetRegionScansCount
GdipGetRegionScans
GdipDeleteMatrix
GdipFillPolygon
GdipDrawPolygon
GdipCreateStringFormat
GdipGetStringFormatTrimming
GdipGetStringFormatHotkeyPrefix
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatFlags
GdipGraphicsClear
GdipCreateFromHDC
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipGetVisibleClipBounds
GdipSetClipRect
GdipSetClipRegion
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDrawImageRect
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipLoadImageFromStream
GdipGetFamilyName
GdipDeleteFont
GdiplusStartup
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipGetImageHeight

imm32

ImmAssociateContext
ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext

iphlpapi

GetAdaptersInfo
SendARP

oledlg

ord8

oleaut32

SafeArrayDestroy
VariantClear
SysAllocString
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate

mpr

WNetCloseEnum
WNetEnumResourceA
WNetOpenEnumA
WNetAddConnection2A
WNetCancelConnection2A

winmm

waveOutGetNumDevs
mciSendStringA
waveOutGetDevCapsA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

comdlg32

GetFileTitleA
PrintDlgA

winspool.drv

OpenPrinterA
SetPrinterA
DocumentPropertiesA
GetPrinterA
ClosePrinter
EnumPrintersA

wininet

InternetOpenA
InternetGetConnectedState
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
InternetCloseHandle
InternetOpenUrlA

Sections

.wurfewi
Size: 986KB - Virtual size: 986KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wurfewi
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wurfewi
Size: 366KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wurfewi
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee683f7bdf39e401d4f1b56beebbff29

Headers

File Characteristics

Imports

shlwapi

ws2_32

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

gdiplus

imm32

iphlpapi

oledlg

oleaut32

mpr

winmm

version

comdlg32

winspool.drv

wininet

Sections

.wurfewi Size: 986KB - Virtual size: 986KB

.wurfewi Size: 60KB - Virtual size: 60KB

.wurfewi Size: 366KB - Virtual size: 430KB

.wurfewi Size: 512B - Virtual size: 16B

.wurfewi
Size: 986KB - Virtual size: 986KB

.wurfewi
Size: 60KB - Virtual size: 60KB

.wurfewi
Size: 366KB - Virtual size: 430KB

.wurfewi
Size: 512B - Virtual size: 16B