Webzen
_�����ӳ���
���ӵ�������
Behavioral task
behavioral1
Sample
bf30248b7299bd424c3e9f7b12e7532b2fc7d93e6e0d11738d417627292f2266.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bf30248b7299bd424c3e9f7b12e7532b2fc7d93e6e0d11738d417627292f2266.dll
Resource
win10v2004-20240802-en
Target
bf30248b7299bd424c3e9f7b12e7532b2fc7d93e6e0d11738d417627292f2266
Size
236KB
MD5
541eb85d88ba1882b17c9c72b9abcb8d
SHA1
456edd084a7e2bc78551a99ddb361c688df6f75a
SHA256
bf30248b7299bd424c3e9f7b12e7532b2fc7d93e6e0d11738d417627292f2266
SHA512
6c3ddb761e626fadc11e51d8633fe46112d84c5294407c530c2bef9d9cd962930fe4a48d948e212b78f5b16801ab70e6c0f701a4ec69d39017109e013ae7a540
SSDEEP
3072:nV9vwxa6JMOZwtRru93FPiddT2kKxcK3gp0n8po/3hw22tgoT3d:nV9vEa6B1wxDKxDgKDvvroT3
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
bf30248b7299bd424c3e9f7b12e7532b2fc7d93e6e0d11738d417627292f2266 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LCMapStringA
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetDiskFreeSpaceA
MulDiv
GetFileSize
ReadFile
lstrlenA
GetWindowsDirectoryA
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
InterlockedDecrement
SetErrorMode
lstrcatA
lstrcpyA
MoveFileA
GetVersion
GlobalFlags
InterlockedIncrement
SetLastError
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
DeleteFileA
GetPrivateProfileStringA
GetModuleFileNameA
CreateFileA
WriteFile
Sleep
WritePrivateProfileStringA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
VirtualProtectEx
VirtualQueryEx
GetModuleHandleA
CloseHandle
GetCurrentProcess
QueryDosDeviceA
GetLogicalDriveStringsA
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
VirtualAllocEx
CopyFileA
GetTempPathA
GetVersionExA
lstrcpyn
TerminateProcess
GetCurrentProcessId
RtlZeroMemory
LocalFree
LocalAlloc
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetLastError
LeaveCriticalSection
EnterCriticalSection
CreateThread
InitializeCriticalSection
HeapCreate
CreateIoCompletionPort
GetTickCount
RtlMoveMemory
WriteProcessMemory
VirtualProtect
GetProcAddress
lstrcpynA
LoadLibraryA
SetWindowLongA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetDC
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
RegisterWindowMessageA
ReleaseDC
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SetViewportExtEx
GetDeviceCaps
CreateBitmap
OffsetViewportOrgEx
ScaleViewportExtEx
SetViewportOrgEx
SetMapMode
SetTextColor
Escape
GetObjectA
GetStockObject
SetBkColor
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
ExtTextOutA
TextOutA
RectVisible
PtVisible
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
PathFindFileNameA
PathFileExistsA
gethostbyname
htons
inet_addr
connect
WSAStartup
WSASend
WSARecv
WSASocketA
closesocket
ord1141
OpenPrinterA
DocumentPropertiesA
ClosePrinter
ord17
SHGetSpecialFolderPathA
Webzen
_�����ӳ���
���ӵ�������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ