AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
Behavioral task
behavioral1
Sample
a1e2e9de5dfdc0d03b0da7d59a5c1303a7b2d50208859ba3dfdddf98c4a2ba24.dll
Resource
win7-20240903-en
Target
a1e2e9de5dfdc0d03b0da7d59a5c1303a7b2d50208859ba3dfdddf98c4a2ba24
Size
432KB
MD5
d12195166ce6f81c1223f6666700b5a0
SHA1
ef437340ee516e8d4b334fba22937f815f0c039f
SHA256
a1e2e9de5dfdc0d03b0da7d59a5c1303a7b2d50208859ba3dfdddf98c4a2ba24
SHA512
50715309445c4b390f09adee3f7bd54149551e738258c57463d3a8e6dde4b78e788a099eb62a19dc682bd6253029cdb8c6d870abd74de377d1f8d9edc08068f2
SSDEEP
12288:kov9YJjrV+pJR6cuXFqaYCL9yKASIAcl3hkWWlyvQA:B+JHVyR6xXky0KASbcdh6yvQA
resource | yara_rule |
---|---|
static1/unpack001/out.upx | family_blackmoon |
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a1e2e9de5dfdc0d03b0da7d59a5c1303a7b2d50208859ba3dfdddf98c4a2ba24 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ