AppInfo
Disable
Disable_
Enable
Enable_
End
Event
GetPluginVersion
GroupMsg
Init
Load
MQ_End
MQ_Event
MQ_Info
MQ_Set
PrivateMsg
Set
Setting
Uninit
onEventMsg
onFriendMsg
onGroupMsg
onGuildMsg
��ʼ��
Behavioral task
behavioral1
Sample
0244def6a863062ea28ed950fadcbcd559b291921e6552b36226ea8fe03b4caf.dll
Resource
win7-20231215-en
Target
0244def6a863062ea28ed950fadcbcd559b291921e6552b36226ea8fe03b4caf
Size
1.3MB
MD5
16c8c3eeb75705ba72b17e718e8eae92
SHA1
a29c63425d63cc77183be9cae67ce8e5e4e27c88
SHA256
0244def6a863062ea28ed950fadcbcd559b291921e6552b36226ea8fe03b4caf
SHA512
d4cd84b861052be211d3407c7120b078adbf94ec22345ef4d1d0bb881736824738b5be232d616f3933e9aae78733a42c894216b5c680d16a7732a7f92e9253a3
SSDEEP
24576:fIjxl9f+YqcXg0bjcltuh79HqBhg/OUB0+c:fSXYZUBc
resource | yara_rule |
---|---|
sample | family_blackmoon |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0244def6a863062ea28ed950fadcbcd559b291921e6552b36226ea8fe03b4caf |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
AppInfo
Disable
Disable_
Enable
Enable_
End
Event
GetPluginVersion
GroupMsg
Init
Load
MQ_End
MQ_Event
MQ_Info
MQ_Set
PrivateMsg
Set
Setting
Uninit
onEventMsg
onFriendMsg
onGroupMsg
onGuildMsg
��ʼ��
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE