DllMain_
_�����ӳ���
Behavioral task
behavioral1
Sample
431570c35c924d339f8708117dc13a543f2b967392b808034cef0d56a776038b.dll
Resource
win7-20230831-en
Target
431570c35c924d339f8708117dc13a543f2b967392b808034cef0d56a776038b
Size
332KB
MD5
3bd688bb9dd2d61d47a4602080ce8e1a
SHA1
07d625d16968321b56471a9b8c78e6f94b8af36f
SHA256
431570c35c924d339f8708117dc13a543f2b967392b808034cef0d56a776038b
SHA512
0aeadb1350770a9bf8cacdac7a91d4c7f44d267ed6a2fce8e108f1663583fa902b4ce632dd62a47520ff9bde74b68ffdfb1678b2f87c7b84f389f345ee659401
SSDEEP
6144:2abiijKeKFB4j1rZ0h6GSqdBWO0sFw0i7OCoPL7u+mJ:HiijKeKFB4j1rugYLT0sFw0i7OVP3a
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
431570c35c924d339f8708117dc13a543f2b967392b808034cef0d56a776038b |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
OpenProcess
TerminateProcess
SetThreadAffinityMask
lstrlenW
WideCharToMultiByte
OpenEventA
CreateEventA
RtlMoveMemory
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
CreateFileA
DeleteFileA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetTickCount
Sleep
GlobalUnlock
GetCurrentProcess
GlobalAlloc
MultiByteToWideChar
GetUserDefaultLCID
GetCommandLineA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
SetWaitableTimer
GlobalLock
CreateWaitableTimerA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PeekMessageA
GetMessageA
DispatchMessageA
GetSystemMetrics
wsprintfA
MessageBoxA
PostMessageA
GetDesktopWindow
GetWindowInfo
FindWindowA
GetWindowThreadProcessId
MsgWaitForMultipleObjects
GetAsyncKeyState
TranslateMessage
OleRun
CoInitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoUninitialize
PathRemoveBlanksA
free
malloc
atoi
_ftol
sprintf
srand
floor
_CIpow
rand
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
strchr
strrchr
realloc
modf
memmove
strncmp
__CxxFrameHandler
_except_handler3
_stricmp
VarR8FromCy
VarR8FromBool
VariantChangeType
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
ShellExecuteA
DllMain_
_�����ӳ���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ