DllMain_
_�����ӳ���
Behavioral task
behavioral1
Sample
5ad56cf6ab2162bdb887753bf5a8d41ef9afeefb964974c299b3a7769e97d8d9.dll
Resource
win7-20230831-en
Target
5ad56cf6ab2162bdb887753bf5a8d41ef9afeefb964974c299b3a7769e97d8d9
Size
332KB
MD5
e9208a880b59ccb2f38609e0febe7d17
SHA1
00af2efd5ef651faaa51d0081d7d2c2af3dbf488
SHA256
5ad56cf6ab2162bdb887753bf5a8d41ef9afeefb964974c299b3a7769e97d8d9
SHA512
4c385cb11147ac68611d9113fb545743ba8617d3236355a036538d391dc883d760ffe505b405b44c0957dd83b4f970ef20522fb038263a0675a802bf9768ec15
SSDEEP
6144:2abiijKeKFB4j1rZ0h6GScdBWO0sFw0i7OCoPL7u+mJ:HiijKeKFB4j1rug6LT0sFw0i7OVP3a
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
5ad56cf6ab2162bdb887753bf5a8d41ef9afeefb964974c299b3a7769e97d8d9 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
OpenProcess
TerminateProcess
SetThreadAffinityMask
lstrlenW
WideCharToMultiByte
OpenEventA
CreateEventA
RtlMoveMemory
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
CreateFileA
DeleteFileA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetTickCount
Sleep
GlobalUnlock
GetCurrentProcess
GlobalAlloc
MultiByteToWideChar
GetUserDefaultLCID
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
SetWaitableTimer
GlobalLock
CreateWaitableTimerA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PeekMessageA
GetMessageA
DispatchMessageA
GetSystemMetrics
wsprintfA
MessageBoxA
PostMessageA
GetDesktopWindow
GetWindowInfo
FindWindowA
GetWindowThreadProcessId
MsgWaitForMultipleObjects
GetAsyncKeyState
TranslateMessage
OleRun
CoInitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoUninitialize
PathRemoveBlanksA
free
malloc
atoi
_ftol
sprintf
srand
floor
_CIpow
rand
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
strchr
strrchr
realloc
modf
memmove
strncmp
__CxxFrameHandler
_except_handler3
_stricmp
VarR8FromCy
VarR8FromBool
VariantChangeType
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
ShellExecuteA
DllMain_
_�����ӳ���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ