Hello
ȡָ������_
Behavioral task
behavioral1
Sample
b5bbfb11ba78017f2a30db4eedef3472b33addd6f9e5839e8e6ec53662356115.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b5bbfb11ba78017f2a30db4eedef3472b33addd6f9e5839e8e6ec53662356115.dll
Resource
win10v2004-20230915-en
Target
b5bbfb11ba78017f2a30db4eedef3472b33addd6f9e5839e8e6ec53662356115
Size
44KB
MD5
1a71e35c776399166db4420ad3468963
SHA1
3bb62b2dea6a51c8d5aee0523b7f144135a9e646
SHA256
b5bbfb11ba78017f2a30db4eedef3472b33addd6f9e5839e8e6ec53662356115
SHA512
1c37334a453e508c9185d4dd855085e22238b5885a20b8cf60d8ae2684a49584fde0d02af962213293760bef4bfb307d8b03f09cb499cf181534cbf938dbcd85
SSDEEP
768:c3mcjDEyy+9aZCyFQSIT+qzpjzmEM/CueJLSh:c3mcjBy+IZCyFQSIT+01mEuw
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
b5bbfb11ba78017f2a30db4eedef3472b33addd6f9e5839e8e6ec53662356115 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateFileA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
VirtualProtect
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
CreateThread
GetLocalTime
Sleep
GetCommandLineA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
LCMapStringA
RtlMoveMemory
FormatMessageA
GetModuleHandleA
GetLastError
IsBadReadPtr
MessageBoxA
GetAsyncKeyState
DispatchMessageA
PeekMessageA
GetMessageA
keybd_event
wsprintfA
TranslateMessage
FindWindowA
CryptAcquireContextA
PathFindExtensionA
strstr
sprintf
atoi
_ftol
strrchr
strchr
free
realloc
malloc
VariantTimeToSystemTime
SystemTimeToVariantTime
Hello
ȡָ������_
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ