CheckAutoRun
SetArParm
Behavioral task
behavioral1
Sample
003e687c89031bfbbeb96184fd7f5d8e3bbd16ca9c37114eeac724d120846c81.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
003e687c89031bfbbeb96184fd7f5d8e3bbd16ca9c37114eeac724d120846c81.dll
Resource
win10v2004-20230915-en
Target
003e687c89031bfbbeb96184fd7f5d8e3bbd16ca9c37114eeac724d120846c81
Size
184KB
MD5
eee144cdf9a8e349025bd1d1705493eb
SHA1
37e3599ddf57bc85d4a6e10df6ebcfc6d9966b8a
SHA256
003e687c89031bfbbeb96184fd7f5d8e3bbd16ca9c37114eeac724d120846c81
SHA512
64918bdd7be388c38a2ccedba0a28c6755e6d9036d1c29c2c69378ee119c05dc338493f8bce5461971cdb535638da97a5704a6fd950d13ee0467996011d56e0c
SSDEEP
3072:C6YlrpA1j9zf7Y6fY+jtf0MVJEKreCo4tyNgPt:C6YwwWqCLty+
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
003e687c89031bfbbeb96184fd7f5d8e3bbd16ca9c37114eeac724d120846c81 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
GetUserDefaultLCID
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
FlushFileBuffers
RaiseException
SetStdHandle
IsBadCodePtr
HeapAlloc
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
LCMapStringW
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetModuleHandleA
GetProcessHeap
WideCharToMultiByte
GetTempPathW
lstrlenW
FindClose
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
FindFirstFileW
MultiByteToWideChar
SetUnhandledExceptionFilter
FileTimeToSystemTime
FileTimeToLocalFileTime
ReadFile
SetFilePointer
CloseHandle
CreateFileA
WriteFile
UnmapViewOfFile
SystemTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
CreateDirectoryA
GetFileAttributesA
SetFileTime
GetVersion
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
SysFreeString
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VariantCopy
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
VariantChangeType
VariantTimeToSystemTime
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SystemTimeToVariantTime
VarR8FromCy
VarR8FromBool
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CryptReleaseContext
SHGetSpecialFolderPathW
ShellExecuteW
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CLSIDFromProgID
CheckAutoRun
SetArParm
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ