BT������
DLL�ӿ�
����_�����Ƿ���Ч
����_ȡ����
�ͻ��˻ص��ο�
��������
�߳�_��ʼ��COM��
�߳�_ȡ��COM��
ָ�뻹ԭ
ָ��ת��
Behavioral task
behavioral1
Sample
cbe7c05503f59b8abdef0fc96f29f88b125c0fecbbf1369272bd4e370065534b.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cbe7c05503f59b8abdef0fc96f29f88b125c0fecbbf1369272bd4e370065534b.dll
Resource
win10v2004-20240802-en
Target
cbe7c05503f59b8abdef0fc96f29f88b125c0fecbbf1369272bd4e370065534b
Size
4.3MB
MD5
61a980ead703df95966eb012c71331a5
SHA1
51212a6687a691133023694777dad7a033b081f8
SHA256
cbe7c05503f59b8abdef0fc96f29f88b125c0fecbbf1369272bd4e370065534b
SHA512
7a0f4cf68ef3ee21ded982c488b90d378e3da787bd5ba4edc1bc0f70d5a8464f8782ce9ba9370e2bd587f291ae24e39c1d3e6af8e5d24441bfb9b44c0c52f672
SSDEEP
98304:8Ed1WUsNtpVRPiaLQOW6OsxY8lxey0QX2tiw:8Er2NDVRnWoxY8TZJ
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
cbe7c05503f59b8abdef0fc96f29f88b125c0fecbbf1369272bd4e370065534b |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetWindowTextA
GetDlgCtrlID
UnregisterClassA
EndDialog
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
RegisterClipboardFormatA
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
PostQuitMessage
SendDlgItemMessageA
IsDialogMessageA
GetParent
GetWindow
PtInRect
IsWindowVisible
GetWindowLongA
GetWindowTextA
GetDlgItem
ShowWindow
UpdateWindow
SystemParametersInfoA
ReleaseDC
FindWindowA
GetMenuItemCount
GetSystemMetrics
UnregisterHotKey
SetWindowLongA
SetCapture
SendMessageA
ScreenToClient
ReleaseCapture
RegisterHotKey
LoadBitmapA
GetSysColor
GetDC
GetCursorPos
CreateWindowExA
SetWindowPos
SetFocus
GetWindowPlacement
IsIconic
SetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
GetPropA
SetPropA
GetClassLongA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
CopyRect
GetClientRect
AdjustWindowRectEx
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
PostThreadMessageA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
FindWindowExA
SendMessageTimeoutA
RegisterWindowMessageA
GetGUIThreadInfo
GetWindowThreadProcessId
GetWindowRect
DestroyMenu
IsWindow
GetForegroundWindow
PostMessageA
EnumChildWindows
wvsprintfA
CallWindowProcA
GetClassNameA
GetTopWindow
OpenFileMappingA
MapViewOfFile
RtlMoveMemory
CloseHandle
LoadLibraryA
GetProcAddress
lstrcpyn
GetModuleHandleA
GetModuleFileNameA
lstrcpynA
GetLocalTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
GlobalFree
MultiByteToWideChar
GetCurrentProcessId
GetCurrentProcess
DeviceIoControl
FreeLibrary
GetCommandLineA
SetFilePointer
GetVersionExA
WideCharToMultiByte
WriteFile
Sleep
WritePrivateProfileStringA
CreateFileA
GetFileSize
ReadFile
GetPrivateProfileStringA
GetTickCount
LCMapStringA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
VirtualFree
VirtualAlloc
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
ReadProcessMemory
SetProcessWorkingSetSize
UnmapViewOfFile
VirtualFreeEx
CreateFileMappingA
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
CreateProcessA
OpenProcess
TerminateProcess
Beep
GetCurrentThread
CreateThread
InterlockedExchange
SetStdHandle
IsBadCodePtr
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
IsBadWritePtr
LCMapStringW
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
FlushFileBuffers
LocalFree
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThreadId
TerminateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersion
FindResourceA
LoadResource
LockResource
SetLastError
lstrlenA
MulDiv
lstrcatA
lstrcpyA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLastError
GetDeviceCaps
TranslateCharsetInfo
DeleteDC
SelectObject
GetNearestPaletteIndex
CreateDIBitmap
DeleteObject
CreateBitmap
SaveDC
RestoreDC
SetBkColor
GetObjectA
GetStockObject
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateFontA
CreatePalette
timeGetTime
WSAStartup
socket
htons
inet_addr
sendto
RegCloseKey
RegOpenKeyExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExA
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoInitialize
CoUninitialize
ord42
ObjectFromLresult
ord8
SafeArrayDestroy
VariantClear
SysAllocString
SafeArrayCreate
VarR8FromBool
VarR8FromCy
DragQueryFileA
DragFinish
DragAcceptFiles
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_BeginDrag
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ImageList_DragMove
ImageList_Add
OpenPrinterA
DocumentPropertiesA
ClosePrinter
BT������
DLL�ӿ�
����_�����Ƿ���Ч
����_ȡ����
�ͻ��˻ص��ο�
��������
�߳�_��ʼ��COM��
�߳�_ȡ��COM��
ָ�뻹ԭ
ָ��ת��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ