GetNewInf
Test_ProcessNotifyLib
Test_�ο��Զ������ݲ���
Test_����
Test_����
Test_��������
Test_����ֵ
Test_������
Test_��Ϣ��
Test_�Զ�����������
��������
Behavioral task
behavioral1
Sample
68b9d9c5b1988acc5d9ec287e90bee40ec30cbec4cc715f9d39b76d72538fb03.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
68b9d9c5b1988acc5d9ec287e90bee40ec30cbec4cc715f9d39b76d72538fb03.dll
Resource
win10v2004-20230703-en
Target
68b9d9c5b1988acc5d9ec287e90bee40ec30cbec4cc715f9d39b76d72538fb03
Size
692KB
MD5
2d2005874c60accac1c40374731039de
SHA1
5fe972e5d2f1db14d50de1c0e49f8511ca6fca46
SHA256
68b9d9c5b1988acc5d9ec287e90bee40ec30cbec4cc715f9d39b76d72538fb03
SHA512
e9f868d9311764a729ad1a9fec5c12c09a70c2183bc104c887943612fb4a24e29d9fb1b0990fba27cfd9cdcb452066e4ba55e3ba4ed3c013eb5c4e6ef20e1bf6
SSDEEP
12288:+URnbxw3Cb9JB1LWfGvc6gMLtTezh7xO6tc4cgCnjpQy/KkBHU5CtTB7XB:+UZbxww9JB1qfG0XMLtTel7xO6tcNJj3
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
68b9d9c5b1988acc5d9ec287e90bee40ec30cbec4cc715f9d39b76d72538fb03 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
UnmapViewOfFile
CreateWaitableTimerA
SetWaitableTimer
CreateMutexA
OpenEventA
CreateEventA
GetComputerNameA
CloseHandle
Module32First
GetCurrentProcess
OpenProcess
ReadProcessMemory
VirtualQueryEx
lstrcpyn
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
WriteFile
FindNextFileA
FindFirstFileA
FindClose
ReadFile
GetFileSize
MapViewOfFile
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
CreateFileMappingA
OpenFileMappingA
GetCurrentProcessId
VirtualFree
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
GetTickCount
CreateProcessA
GetThreadContext
VirtualAllocEx
WriteProcessMemory
SetThreadContext
ResumeThread
TerminateProcess
VirtualProtectEx
OutputDebugStringA
GetLastError
GetFileTime
FileTimeToSystemTime
GetLocalTime
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
VirtualAlloc
Process32Next
Process32First
CreateFileA
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
Module32Next
CreateToolhelp32Snapshot
GetFileAttributesA
VirtualProtect
RtlMoveMemory
GetModuleHandleA
GetWindowThreadProcessId
CreateWindowStationA
MsgWaitForMultipleObjects
EnumChildWindows
GetDlgCtrlID
IsWindowVisible
GetWindowTextA
TranslateMessage
GetClassNameA
PeekMessageA
GetMessageA
wsprintfA
MessageBoxA
DispatchMessageA
SHGetSpecialFolderPathA
ShellExecuteA
WSAStartup
gethostbyname
WSACleanup
closesocket
socket
inet_addr
connect
send
recv
getsockname
ntohs
WSAAsyncSelect
select
gethostname
htons
PathFindFileNameA
PathFileExistsA
PathFindExtensionA
CoUninitialize
CoInitialize
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
sprintf
__CxxFrameHandler
??3@YAXPAX@Z
atoi
_ftol
strtod
strncpy
strncmp
??2@YAPAXI@Z
_atoi64
_CIfmod
floor
strchr
strrchr
free
realloc
malloc
memmove
strstr
calloc
tolower
SystemTimeToVariantTime
VariantTimeToSystemTime
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetNewInf
Test_ProcessNotifyLib
Test_�ο��Զ������ݲ���
Test_����
Test_����
Test_��������
Test_����ֵ
Test_������
Test_��Ϣ��
Test_�Զ�����������
��������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ