TPHelperBase
��������
����_ʮ����ʮ
�ı�����
�ı�����
Behavioral task
behavioral1
Sample
a2116f923a076db8c3e2f29f32a5c6458208b1809ee5451224467a9969246614.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
a2116f923a076db8c3e2f29f32a5c6458208b1809ee5451224467a9969246614.dll
Resource
win10v2004-20231020-en
Target
a2116f923a076db8c3e2f29f32a5c6458208b1809ee5451224467a9969246614
Size
1.3MB
MD5
442d5b2e72dae18b2c5d8b3a43c4e1b5
SHA1
330aaf402407aa257367972565c1366f5e3dc4da
SHA256
a2116f923a076db8c3e2f29f32a5c6458208b1809ee5451224467a9969246614
SHA512
37681157c2012991c82ecd5f13803451c6398db48ecf4874f6063f276a96e840b234634c350c65c95a079a6305fb16b5c45a15043074901eae95e185430ca41f
SSDEEP
24576:pxAQHyzp5Tj+6s2LT1L2vfkFdkXjNpVLN9oi5hyit3WKiDilo6fFNYvTQUXP2fPq:pKx+f5vxN9oODWKimy6f0vmq
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
a2116f923a076db8c3e2f29f32a5c6458208b1809ee5451224467a9969246614 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetLastError
MultiByteToWideChar
GetCurrentThreadId
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
InterlockedDecrement
SetErrorMode
lstrcatA
lstrcpyA
lstrcpynA
GetVersion
GlobalFlags
WritePrivateProfileStringA
InterlockedIncrement
GetCurrentProcess
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersionExA
GetProcessVersion
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
RtlUnwind
TerminateProcess
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
lstrlenA
OpenProcess
ReadProcessMemory
CloseHandle
WriteProcessMemory
VirtualQueryEx
CreateToolhelp32Snapshot
Process32First
Sleep
LCMapStringA
FreeLibrary
GetCommandLineA
WriteFile
GetStartupInfoA
CreateProcessA
WaitForSingleObject
FindFirstFileA
RemoveDirectoryA
FindNextFileA
FindClose
DeleteFileA
GetTickCount
CreateFileA
GetFileSize
ReadFile
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
DeviceIoControl
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
CreateThread
VirtualAllocEx
MoveFileA
CreateDirectoryA
WideCharToMultiByte
Process32Next
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
RtlMoveMemory
VirtualProtect
GetModuleHandleA
SetLastError
SetWindowLongA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
TabbedTextOutA
ReleaseDC
GetDC
GrayStringA
GetDlgItem
FindWindowA
GetWindowThreadProcessId
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SetCursor
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
GetAsyncKeyState
GetClientRect
MsgWaitForMultipleObjects
DrawTextA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetCursorPos
wsprintfA
MessageBoxA
SendMessageA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyA
RegQueryValueExA
RegCloseKey
GetTokenInformation
CreateBitmap
DeleteDC
SaveDC
RestoreDC
SelectObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
GetStockObject
GetDeviceCaps
DeleteObject
PathFileExistsA
SHGetSpecialFolderPathA
ShellExecuteA
OpenPrinterA
ClosePrinter
DocumentPropertiesA
ord17
TPHelperBase
��������
����_ʮ����ʮ
�ı�����
�ı�����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ