_GetToolsVersion
_�����ӳ���
inject_
startGameAndSetHook
startTcgAndSetHook
Behavioral task
behavioral1
Sample
31a0baf3f39aaed95ff9f2f8f26df776cf06b7746b1a6bdc7496ae1046c83e8b.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
31a0baf3f39aaed95ff9f2f8f26df776cf06b7746b1a6bdc7496ae1046c83e8b.dll
Resource
win10v2004-20241007-en
Target
31a0baf3f39aaed95ff9f2f8f26df776cf06b7746b1a6bdc7496ae1046c83e8b
Size
176KB
MD5
e2bfd9c8899a577f5db1cce569d95572
SHA1
cafc2b5691ddcf5e77772f6c27287132b664a117
SHA256
31a0baf3f39aaed95ff9f2f8f26df776cf06b7746b1a6bdc7496ae1046c83e8b
SHA512
7950f02f3c6b5cdc7641bc279ff1ba10b8dcc667b80ff30b1775e8005c325cfc1c4411f3d8487220393a35b5ad8201e296dd9621a72841b48d9840824e98ab83
SSDEEP
1536:b6jZQx7EKpLRAGJe0eLRn9ek6xSSZNEnxRoCTvy00nJBYuH1Cr/7TDEy0gxWR:+1QhEKJaLd0bZNExRoYyNJCuH8MyB
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
31a0baf3f39aaed95ff9f2f8f26df776cf06b7746b1a6bdc7496ae1046c83e8b |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalSize
CreateProcessA
VirtualAllocEx
VirtualFreeEx
CreateRemoteThread
GetExitCodeThread
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetPrivateProfileStringA
GetTickCount
CreateMutexW
ReadFile
GetFileSize
CreateFileA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
lstrcpyn
DeleteCriticalSection
CreateThread
CloseHandle
VirtualProtect
FindWindowA
MessageBoxA
wsprintfA
DispatchMessageA
PeekMessageA
GetMessageA
TranslateMessage
GetAdaptersInfo
_strnicmp
tolower
sprintf
strncmp
??3@YAXPAX@Z
atoi
_ftol
??2@YAPAXI@Z
__CxxFrameHandler
toupper
srand
rand
strrchr
strchr
modf
memmove
free
malloc
PathFileExistsA
_GetToolsVersion
_�����ӳ���
inject_
startGameAndSetHook
startTcgAndSetHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ