ChromeUpdate
RegisterUserNotifyInterface
Behavioral task
behavioral1
Sample
42df2c95683d1334751d1ae2c00d54bb8acd71d4855599e168ecfdcd26cb4156.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
42df2c95683d1334751d1ae2c00d54bb8acd71d4855599e168ecfdcd26cb4156.dll
Resource
win10v2004-20240802-en
Target
42df2c95683d1334751d1ae2c00d54bb8acd71d4855599e168ecfdcd26cb4156
Size
108KB
MD5
cf04480e5450673364506eb0030aadd4
SHA1
dbbebb6b7ccafdb134a91c9bb06f2ecf37db4bb5
SHA256
42df2c95683d1334751d1ae2c00d54bb8acd71d4855599e168ecfdcd26cb4156
SHA512
75646aabaae6019795e9d10365e0bd5b1f774a3ded19dc99c1b754b46f7987271703cb69db7542a8a7c281907a3ce20718627d487d3f2c4a7e6c6b354d56d02e
SSDEEP
1536:NvHKtpR2BR4fFdRe0SBiE3mHXHPvvnBGVPdHn1+N+blyYOoUXYr:9KnoBR4fRe05QmHXvX+PeN+5vOoUXYr
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
42df2c95683d1334751d1ae2c00d54bb8acd71d4855599e168ecfdcd26cb4156 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
GetModuleFileNameA
CreateDirectoryA
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
GetCurrentProcessId
WTSGetActiveConsoleSessionId
WriteFile
CreateFileA
GetCommandLineA
LCMapStringA
SetWaitableTimer
CreateWaitableTimerA
GetWindowsDirectoryA
GetSystemDirectoryA
GetLastError
RtlZeroMemory
GetTempPathA
lstrcpyn
GetProcAddress
GetModuleHandleA
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
PeekMessageA
GetMessageA
MsgWaitForMultipleObjects
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetFileTitleA
CreateProcessAsUserA
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CLSIDFromString
CoUninitialize
CLSIDFromProgID
CoInitialize
OleRun
CoCreateInstance
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayAllocData
SafeArrayAllocDescriptor
VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayGetUBound
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
InternetConnectA
PathFileExistsA
WTSQueryUserToken
CreateEnvironmentBlock
free
_ftol
atoi
??2@YAPAXI@Z
??3@YAXPAX@Z
strchr
sprintf
_CIfmod
strrchr
realloc
modf
strncmp
__CxxFrameHandler
memmove
malloc
SHGetSpecialFolderPathA
ChromeUpdate
RegisterUserNotifyInterface
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ