StartHook
����_ʮ����ʮ
�ֽڼ���ԭ
Behavioral task
behavioral1
Sample
9d4f617127a5208d9d2268fe651f8bcc428775b7d5ec621a9eaccae198cbe904.dll
Resource
win7-20230712-en
Target
9d4f617127a5208d9d2268fe651f8bcc428775b7d5ec621a9eaccae198cbe904
Size
140KB
MD5
b505bd9d3615174e74f2c18d92e3d8ca
SHA1
c4b3169cbbad81d08c6c619473e84170356fb016
SHA256
9d4f617127a5208d9d2268fe651f8bcc428775b7d5ec621a9eaccae198cbe904
SHA512
d82b29521100771077454eff94ef2fcc3821f566dddea2800d106abb81206733bd6397711611695c5d481de23409d303d2e8f00cad54ad4904ef953b7aff650a
SSDEEP
1536:oRYJFphE1X+0410kjr42Z9wjTvB+Omkwb2dihuUp+gP4TkoYSLNMt/ER:oAWkjfwC8g7uNMt
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
9d4f617127a5208d9d2268fe651f8bcc428775b7d5ec621a9eaccae198cbe904 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FreeLibrary
CreateToolhelp32Snapshot
Module32First
VirtualProtect
lstrcpynA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WideCharToMultiByte
GetCommandLineW
Sleep
GetModuleFileNameA
GetTickCount
CreateFileA
SetFilePointer
GetLocalTime
WriteFile
GetCommandLineA
GetProcAddress
LoadLibraryA
LCMapStringA
CloseHandle
GetModuleHandleA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
MultiByteToWideChar
RaiseException
IsBadWritePtr
VirtualAlloc
WriteProcessMemory
ReadProcessMemory
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetModuleHandleA
GetProcessHeap
VirtualProtectEx
HeapAlloc
HeapFree
IsBadReadPtr
ExitProcess
PeekMessageA
PostMessageA
FindWindowA
SendMessageA
GetWindowThreadProcessId
SetWindowsHookExA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
wsprintfA
_adjust_fdiv
malloc
free
_initterm
CommandLineToArgvW
StartHook
����_ʮ����ʮ
�ֽڼ���ԭ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ