GET_Game_name
GET_name_����
main
Behavioral task
behavioral1
Sample
01fe5970d12953b33f535d5e20b19028a94c99857313ca797ddcc2c8ab17d576.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
01fe5970d12953b33f535d5e20b19028a94c99857313ca797ddcc2c8ab17d576.dll
Resource
win10v2004-20230220-en
Target
01fe5970d12953b33f535d5e20b19028a94c99857313ca797ddcc2c8ab17d576
Size
216KB
MD5
d3689524213e74b4de17966569993618
SHA1
69c668f4232d32c62af6232b4ac77fa8e46225fb
SHA256
01fe5970d12953b33f535d5e20b19028a94c99857313ca797ddcc2c8ab17d576
SHA512
b8944b2b92d6293486827761a77ae89f34ac44864c320b6520cfd5857184ea5414bd1c86d5969abeaf5f099c46ba6a68264db35271319b528cd880b73d00503d
SSDEEP
3072:PH/Vf+hk0Df0C1HasXPiw+EQ2XwpOAS6qap/OEt81UXp:PH/VWhk6v16hEjXwpOA3qH0
Processes:
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
Processes:
resource |
---|
01fe5970d12953b33f535d5e20b19028a94c99857313ca797ddcc2c8ab17d576 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
SetWaitableTimer
CloseHandle
lstrcpyn
VirtualProtect
GetTickCount
lstrlenW
WideCharToMultiByte
GetCurrentProcess
OpenProcess
LocalAlloc
LocalFree
VirtualQueryEx
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
RtlMoveMemory
VirtualFreeEx
LoadLibraryExA
GetProcAddress
FreeLibrary
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
MultiByteToWideChar
GetUserDefaultLCID
SetFilePointer
WriteFile
GetFileSize
ReadFile
SetEndOfFile
CreateFileA
GetCommandLineA
GetModuleFileNameA
LoadLibraryA
LCMapStringA
EnterCriticalSection
CreateWaitableTimerA
LeaveCriticalSection
LCMapStringW
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
RaiseException
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
CreateThread
InitializeCriticalSection
GetCurrentProcessId
DeleteCriticalSection
TerminateThread
Sleep
GetVersion
RtlUnwind
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
HeapCreate
IsWindowVisible
FindWindowExA
GetWindowThreadProcessId
GetParent
GetClassNameA
GetWindowTextLengthW
GetWindowTextW
GetAncestor
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
CallWindowProcA
RegisterWindowMessageA
SetWindowLongA
EnumWindows
MsgWaitForMultipleObjects
CoUninitialize
OleRun
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitialize
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
connect
inet_addr
WSAGetLastError
recv
gethostbyname
ioctlsocket
inet_ntoa
send
__WSAFDIsSet
select
closesocket
htons
socket
WSAStartup
WSACleanup
shutdown
GET_Game_name
GET_name_����
main
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ