StartHook
����_ʮ����ʮ
�ֽڼ���ԭ
Behavioral task
behavioral1
Sample
39048f0cbdb67be6f52c641fbb3956edd4ac3aecfa9c44c137da76b67a04714f.dll
Resource
win7-20230712-en
Target
39048f0cbdb67be6f52c641fbb3956edd4ac3aecfa9c44c137da76b67a04714f
Size
140KB
MD5
7bb9d559a2ff7f19f847fb779e833ea1
SHA1
0c032779a248645a5a5178e7255a26e32686722f
SHA256
39048f0cbdb67be6f52c641fbb3956edd4ac3aecfa9c44c137da76b67a04714f
SHA512
96c7679bf964ae7ed39894ff5b8fce0ff0296971bc827dbff8b0c4a4dbf793f835caf6b5212fbe82bac4b72b2a18c944aa6a7b519b0078009d1e6bc6ea607d3d
SSDEEP
1536:TRYJFphE1X+0410kjr42Z9wjTvB+Omkwb2dihuUp+gP4TkoYSLNMtIER:TAWkjfwC8g7uNMt
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
39048f0cbdb67be6f52c641fbb3956edd4ac3aecfa9c44c137da76b67a04714f |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FreeLibrary
CreateToolhelp32Snapshot
Module32First
VirtualProtect
lstrcpynA
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WideCharToMultiByte
GetCommandLineW
Sleep
GetModuleFileNameA
GetTickCount
CreateFileA
SetFilePointer
GetLocalTime
WriteFile
GetCommandLineA
GetProcAddress
LoadLibraryA
LCMapStringA
CloseHandle
GetModuleHandleA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
MultiByteToWideChar
RaiseException
IsBadWritePtr
VirtualAlloc
WriteProcessMemory
ReadProcessMemory
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetModuleHandleA
GetProcessHeap
VirtualProtectEx
HeapAlloc
HeapFree
IsBadReadPtr
ExitProcess
PeekMessageA
PostMessageA
FindWindowA
SendMessageA
GetWindowThreadProcessId
SetWindowsHookExA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
wsprintfA
_adjust_fdiv
malloc
free
_initterm
CommandLineToArgvW
StartHook
����_ʮ����ʮ
�ֽڼ���ԭ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ