G_tk
a
debug
Behavioral task
behavioral1
Sample
NEAS.61f8612b1c0831742e5f2e28b94df460.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.61f8612b1c0831742e5f2e28b94df460.dll
Resource
win10v2004-20231020-en
Target
NEAS.61f8612b1c0831742e5f2e28b94df460.exe
Size
480KB
MD5
61f8612b1c0831742e5f2e28b94df460
SHA1
df54ec0431ce593e49d0d3e1adb663b659f49be7
SHA256
b1d2bc96d6ba1ed36e4d4e0a76dec9022705dcecf7cffbf1354ec6e1230e7f9b
SHA512
2c43c0ed2de6fa99bc0329f9365c6db88e0c34889eee261b1f66f8c4a4d507975e328edfb5168c642f09123b31a988ee32bd8e526643e3da63d5fb25d8201ce8
SSDEEP
6144:3ltViQwq/WD2q63X63hGxBKPgBGT2mHsNi+J1MefDM:3ljiQwqe273whGxBKPgBG6tiI1X
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
NEAS.61f8612b1c0831742e5f2e28b94df460.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
OpenEventA
CreateEventA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateWaitableTimerA
SetWaitableTimer
RtlMoveMemory
lstrcatA
VirtualAlloc
VirtualFree
LoadLibraryA
GetProcAddress
lstrlenA
RtlFillMemory
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetTickCount
GetUserDefaultLCID
CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
SetFilePointer
GetCommandLineA
FreeLibrary
LCMapStringA
WideCharToMultiByte
FlushFileBuffers
SetStdHandle
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetACP
GetCPInfo
RaiseException
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
RtlUnwind
GetVersion
MultiByteToWideChar
CreateThread
GetClassNameA
ShowWindow
SetForegroundWindow
SetWindowPos
PeekMessageA
GetWindowTextA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
GetWindowThreadProcessId
GetMessageA
IsWindowVisible
CLSIDFromString
OleRun
IIDFromString
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
CLSIDFromProgID
CoInitializeSecurity
PathFileExistsA
StrToIntExA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA
InternetOpenA
gethostbyname
WSAStartup
gethostname
WSACleanup
inet_addr
SendARP
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
VariantChangeType
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
VariantClear
SafeArrayDestroy
SysAllocString
SysFreeString
G_tk
a
debug
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ