����_IDȡ������
ȡ�������ݵ�ַ_�ı�
д���ڴ�_������
Behavioral task
behavioral1
Sample
bd9021e21e120d2e7445993718383cb1ae053d1e021b5bd38f4c2c70e369f9a9.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bd9021e21e120d2e7445993718383cb1ae053d1e021b5bd38f4c2c70e369f9a9.dll
Resource
win10v2004-20230220-en
Target
bd9021e21e120d2e7445993718383cb1ae053d1e021b5bd38f4c2c70e369f9a9
Size
60KB
MD5
e14642fbc0f1476e66c3735db66c5818
SHA1
0b2261d0c6c2210b55ee2fe3c9647593c9f9310f
SHA256
bd9021e21e120d2e7445993718383cb1ae053d1e021b5bd38f4c2c70e369f9a9
SHA512
c5f3e1882a94e275f5bc74b8a0655f448e506e8fe97c0f795c4d9a2587e03a72cfb491a2cdaed09f3fe615dd954151dc585638ac63f024299d880131d8c11dcc
SSDEEP
1536:uaxdndhzVFIZiVjqdPnd+rjlwWEHgQqh2//tcgAw1qS2z9JxF3aURBS64T9D3pd4:uaxBbp+ZiVGdPnd+rjlwWEHgQqh2//tM
Processes:
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
Processes:
resource |
---|
bd9021e21e120d2e7445993718383cb1ae053d1e021b5bd38f4c2c70e369f9a9 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetProcAddress
CreateProcessW
Sleep
WideCharToMultiByte
VirtualAlloc
VirtualFree
VirtualProtect
WriteProcessMemory
Module32First
Module32Next
CloseHandle
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
GetModuleHandleA
IsBadReadPtr
SetFileAttributesA
GetPrivateProfileStringA
GetCommandLineA
GetModuleFileNameA
FreeLibrary
LoadLibraryA
LCMapStringA
DeleteCriticalSection
CreateThread
GetTickCount
HeapFree
CreateToolhelp32Snapshot
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MessageBoxA
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetConnectA
InternetCloseHandle
_stricmp
__CxxFrameHandler
strncmp
memmove
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
atoi
_ftol
strtod
floor
_CIpow
strrchr
strchr
modf
malloc
free
����_IDȡ������
ȡ�������ݵ�ַ_�ı�
д���ڴ�_������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ