DllGetClassObject
�ı����ֽڼ����ı�
�ֽڼ����ı����ֽڼ�
Behavioral task
behavioral1
Sample
e6047ebbe5eae59dc8ab079cc13d9fd6e2a802d8e3d9017035e57fcd144700d5.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e6047ebbe5eae59dc8ab079cc13d9fd6e2a802d8e3d9017035e57fcd144700d5.dll
Resource
win10v2004-20240802-en
Target
e6047ebbe5eae59dc8ab079cc13d9fd6e2a802d8e3d9017035e57fcd144700d5
Size
360KB
MD5
bb236831c9f3550b2077f7e7bd05c591
SHA1
3d974e8429a81b03d505a58fcc5045ad0538762d
SHA256
e6047ebbe5eae59dc8ab079cc13d9fd6e2a802d8e3d9017035e57fcd144700d5
SHA512
dba55bb54e59374ac32055943f6ccfe6e981220833b750dbe7049074134a4cae49cb23cb4e0887b72ba06dcff7b6555143d3604645576229a1b9f94ff1337b65
SSDEEP
6144:EThYs5iltMojGmu9zR0tHrP65imxkBNNptEZfmXfxJGHni7k7oS59l:ETJitMzCLP65imivpQfmXOi7+oS5n
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
e6047ebbe5eae59dc8ab079cc13d9fd6e2a802d8e3d9017035e57fcd144700d5 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CopyFileA
MoveFileA
GetLocalTime
WriteFile
CreateFileA
GetTickCount
GetVersionExA
GetCommandLineA
FreeLibrary
LoadLibraryA
DeleteFileA
DeleteCriticalSection
CreateThread
IsBadReadPtr
GetModuleFileNameA
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetExitCodeProcess
GetCurrentProcessId
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
GetProcAddress
GetModuleHandleA
RtlMoveMemory
TerminateProcess
OpenProcess
CloseHandle
SetWaitableTimer
CreateWaitableTimerA
LocalFree
lstrcpyn
LCMapStringA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
DispatchMessageA
wsprintfA
MessageBoxA
GetInputState
TranslateMessage
GetMessageA
PeekMessageA
MsgWaitForMultipleObjects
LookupPrivilegeValueA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
AdjustTokenPrivileges
OpenProcessToken
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
LookupAccountNameA
WSAStartup
inet_addr
WSACleanup
gethostbyname
PathFileExistsA
free
malloc
atoi
_ftol
__CxxFrameHandler
??3@YAXPAX@Z
_CIfmod
sprintf
modf
srand
rand
strrchr
strchr
realloc
memmove
strncmp
_stricmp
SHGetSpecialFolderPathA
ShellExecuteA
DllGetClassObject
�ı����ֽڼ����ı�
�ֽڼ����ı����ֽڼ�
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ