AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
Behavioral task
behavioral1
Sample
f1b94ef2929efc33e766c86773412f7b82250b6f1869ddf74d0dbfe331e34dff.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f1b94ef2929efc33e766c86773412f7b82250b6f1869ddf74d0dbfe331e34dff.dll
Resource
win10v2004-20240802-en
Target
f1b94ef2929efc33e766c86773412f7b82250b6f1869ddf74d0dbfe331e34dff
Size
488KB
MD5
ef7431d0e4902172b475453bab098cc8
SHA1
fbaa6757c666f7730b3c45585ebb6d9276054f2f
SHA256
f1b94ef2929efc33e766c86773412f7b82250b6f1869ddf74d0dbfe331e34dff
SHA512
7227930f2f2bd974af95d9521f6b593e8f63eba3458e77d2278936ae9e71dccf2212c608ca49bb5b67427bd8f72269b0e1eca25404cc4069f505c97f1ecc4aa6
SSDEEP
12288:O2ZKgoea7nvNyvOOZPw2D91na+WV1ds+VFChKLN+TTGxWKRWaMS0KX:O2VeTvNyvLlPZuFCgeGxWKRWaMS0KX
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
f1b94ef2929efc33e766c86773412f7b82250b6f1869ddf74d0dbfe331e34dff |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
VirtualFreeEx
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
FreeLibrary
IsBadReadPtr
GetEnvironmentVariableA
GetCommandLineA
GetModuleFileNameA
LCMapStringA
GetProcAddress
HeapFree
LoadLibraryA
modf
malloc
??3@YAXPAX@Z
free
strncmp
strrchr
memmove
sprintf
atoi
_ftol
__CxxFrameHandler
GetMessageA
PeekMessageA
DispatchMessageA
wsprintfA
MessageBoxA
TranslateMessage
AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ