FreeAllCdsFile
GetVarPtr
GetVcodeFromBuffer
GetVcodeFromFile
GetVcodeFromHBitmap
GetVcodeFromHWND
GetVcodeFromIECache
LoadCdsFromBuffer
LoadCdsFromFile
SetTimeOut
Behavioral task
behavioral1
Sample
搜狗邮箱无限注册机/SogouRegister.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
搜狗邮箱无限注册机/SogouRegister.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
搜狗邮箱无限注册机/Vcode.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
搜狗邮箱无限注册机/Vcode.dll
Resource
win10v2004-20221111-en
Target
d21ff82d6dc9d42b5e3277e6aa697a45f0a229e1d8ec847adeed45ef91f4056f
Size
933KB
MD5
86592cfd26486d9179fee6392087554d
SHA1
7f70b904f72959d7387965118f0db6a2548379f5
SHA256
d21ff82d6dc9d42b5e3277e6aa697a45f0a229e1d8ec847adeed45ef91f4056f
SHA512
e070bc2a0a6f97083fb56d4cd480e1c446bb864e956487d9a2fe52dd4fece67425a5099e2080eb283b93b5fb225a5d5879c1ea83ad5e7520f0ee814fc02008a0
SSDEEP
24576:M+NAxbV2oXsn/LkEPHuloxkLC6AmUhw/rkPgbN1:MBpji/R+cuwmUGYy
resource | yara_rule |
---|---|
static1/unpack001/搜狗邮箱无限注册机/Vcode.dll | family_blackmoon |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
FreeAllCdsFile
GetVarPtr
GetVcodeFromBuffer
GetVcodeFromFile
GetVcodeFromHBitmap
GetVcodeFromHWND
GetVcodeFromIECache
LoadCdsFromBuffer
LoadCdsFromFile
SetTimeOut
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ