Webzen
_�����ӳ���
���ӵ�������
Behavioral task
behavioral1
Sample
af0d9829f2e54f97dbfdf8b85e2a5614291efc8741bb697b9491ccf959b1d311.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
af0d9829f2e54f97dbfdf8b85e2a5614291efc8741bb697b9491ccf959b1d311.dll
Resource
win10v2004-20240802-en
Target
af0d9829f2e54f97dbfdf8b85e2a5614291efc8741bb697b9491ccf959b1d311
Size
236KB
MD5
1a301d9fb1328a5eab1ce6d7aebc05f4
SHA1
052ef99db5ff9f04adac2a699e14d3241db395d4
SHA256
af0d9829f2e54f97dbfdf8b85e2a5614291efc8741bb697b9491ccf959b1d311
SHA512
342e969476421b6c39b2a107ddf26660d27fd494160497926e385e05185f01ebfacfff5dc56c27c590dc2b0f8b051a6b4e32b402bff1b83d7f7a88cb59041e2c
SSDEEP
3072:7VpMaXHT7q7TdJcDHxYL3zghuukyhcKfgM0n8ponPwB2tgV/u:7VaaXz7sL36u7yhjgRDarV/
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
af0d9829f2e54f97dbfdf8b85e2a5614291efc8741bb697b9491ccf959b1d311 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LCMapStringA
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetDiskFreeSpaceA
MulDiv
GetFileSize
ReadFile
lstrlenA
GetWindowsDirectoryA
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
InterlockedDecrement
SetErrorMode
lstrcatA
lstrcpyA
MoveFileA
GetVersion
GlobalFlags
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
DeleteFileA
GetPrivateProfileStringA
GetModuleFileNameA
CreateFileA
WriteFile
Sleep
WritePrivateProfileStringA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
VirtualProtectEx
VirtualQueryEx
GetModuleHandleA
QueryDosDeviceA
GetLogicalDriveStringsA
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
VirtualAllocEx
CopyFileA
GetTempPathA
GetVersionExA
lstrcpyn
TerminateProcess
GetCurrentProcessId
RtlZeroMemory
LocalFree
LocalAlloc
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetLastError
LeaveCriticalSection
EnterCriticalSection
CreateThread
InitializeCriticalSection
HeapCreate
CreateIoCompletionPort
GetTickCount
RtlMoveMemory
WriteProcessMemory
VirtualProtect
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpynA
GetCurrentProcess
SetWindowLongA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetDC
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
RegisterWindowMessageA
ReleaseDC
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SetViewportExtEx
GetDeviceCaps
CreateBitmap
OffsetViewportOrgEx
ScaleViewportExtEx
SetViewportOrgEx
SetMapMode
SetTextColor
Escape
GetObjectA
GetStockObject
SetBkColor
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
ExtTextOutA
TextOutA
RectVisible
PtVisible
RegCloseKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
PathFindFileNameA
PathFileExistsA
WSAStartup
gethostbyname
htons
inet_addr
WSASend
WSARecv
WSASocketA
closesocket
connect
ord1141
OpenPrinterA
DocumentPropertiesA
ClosePrinter
ord17
SHGetSpecialFolderPathA
Webzen
_�����ӳ���
���ӵ�������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ