WSPStartup
aaa
Behavioral task
behavioral1
Sample
829870b471532185c142ec6a88436d203bcf7a7e3d62c8559028240afbfca40d.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
829870b471532185c142ec6a88436d203bcf7a7e3d62c8559028240afbfca40d.dll
Resource
win10v2004-20240802-en
Target
829870b471532185c142ec6a88436d203bcf7a7e3d62c8559028240afbfca40d
Size
92KB
MD5
828df583a72214431fe7af8600b57049
SHA1
c3efbbf36b206435ecf95d8d7a7bd7e220351492
SHA256
829870b471532185c142ec6a88436d203bcf7a7e3d62c8559028240afbfca40d
SHA512
9e4f04a90ba7e40e42adceabe5074da76c42a9e9955e34f9f525aae1a60166ff4b7798be4a4ce76774e3944204e218149ef374ce6450672edf132472504db9ff
SSDEEP
768:Ga659xm8rc27i73zcn4I7RhZlqPhK6J2RDeHvyZWgxL7UWANbDA06:Ga6/rL7i7M4I9hZlqPJ2YPy/LG8
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
829870b471532185c142ec6a88436d203bcf7a7e3d62c8559028240afbfca40d |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
DeleteFileA
Sleep
WritePrivateProfileStringA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetProcessHeap
GetWindowsDirectoryA
GetSystemDirectoryA
WriteProcessMemory
ReadProcessMemory
VirtualProtectEx
VirtualQueryEx
TerminateProcess
GetCurrentProcessId
lstrcpyn
GetCurrentProcess
LocalFree
LocalAlloc
GetTickCount
DeleteCriticalSection
CreateThread
CloseHandle
OpenProcess
GetTempPathA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
CryptDestroyHash
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptGetHashParam
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
OpenProcessToken
modf
memmove
__CxxFrameHandler
strchr
strrchr
strncmp
strncpy
strtod
sprintf
_ftol
atoi
malloc
free
??2@YAPAXI@Z
??3@YAXPAX@Z
realloc
SHGetSpecialFolderPathA
WSPStartup
aaa
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ