Webzen
_�����ӳ���
���ӵ�������
Behavioral task
behavioral1
Sample
7d42a4f69b305ca62e5e3ab8fb77205c1b62474240d2a9f9740a43bd4fc81659.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7d42a4f69b305ca62e5e3ab8fb77205c1b62474240d2a9f9740a43bd4fc81659.dll
Resource
win10v2004-20241007-en
Target
7d42a4f69b305ca62e5e3ab8fb77205c1b62474240d2a9f9740a43bd4fc81659
Size
236KB
MD5
c332ae04efc67586704561140b2a578f
SHA1
18d3de62022385c0430a9d8da212ca103137434f
SHA256
7d42a4f69b305ca62e5e3ab8fb77205c1b62474240d2a9f9740a43bd4fc81659
SHA512
ceee15d4629568294d294794de68eed8a166f3e4fb993be2442e413211ccfbd8f81b90976be8276c1174c4689de5117c8288a7f8a141c90213672ee4c81906f8
SSDEEP
3072:5OTsxgbTBlGdMFT+S+jqHQPIiCqcNCDAO4ZGcH4nQzxnJi72t+tsnQ:5OTsm+j2QNCqECDoZvh1M7pK
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
7d42a4f69b305ca62e5e3ab8fb77205c1b62474240d2a9f9740a43bd4fc81659 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetQueuedCompletionStatus
PostQueuedCompletionStatus
LocalAlloc
LocalFree
LoadLibraryA
RtlZeroMemory
GetCurrentProcessId
TerminateProcess
lstrcpyn
lstrlenA
GetWindowsDirectoryA
GetCurrentThread
lstrcmpiA
lstrcmpA
GlobalDeleteAtom
GlobalAlloc
GlobalLock
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
InterlockedDecrement
SetErrorMode
lstrcatA
lstrcpyA
GetLastError
GetVersion
GlobalFlags
InterlockedIncrement
SetLastError
GetProcAddress
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapSize
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
GetVersionExA
LCMapStringA
FreeLibrary
GetCommandLineA
WritePrivateProfileStringA
GetCurrentDirectoryA
GetDiskFreeSpaceA
RtlMoveMemory
MulDiv
GetFileSize
ReadFile
MoveFileA
DeleteFileA
GetPrivateProfileStringA
GetModuleFileNameA
CreateFileA
WriteFile
Sleep
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
VirtualProtectEx
VirtualQueryEx
GetModuleHandleA
CloseHandle
GetCurrentProcess
WriteProcessMemory
VirtualProtect
QueryDosDeviceA
GetLogicalDriveStringsA
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
VirtualAllocEx
CopyFileA
GlobalFindAtomA
GetTempPathA
LeaveCriticalSection
EnterCriticalSection
CreateThread
InitializeCriticalSection
HeapCreate
CreateIoCompletionPort
GetTickCount
lstrcpynA
SetWindowLongA
SetWindowPos
ShowWindow
SetFocus
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
ReleaseDC
GetDC
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
MessageBoxA
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
SetForegroundWindow
GetActiveWindow
GetForegroundWindow
IsWindowEnabled
GetParent
EnableWindow
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
CryptCreateHash
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptAcquireContextA
PathFindFileNameA
PathFileExistsA
WSASocketA
WSARecv
closesocket
WSAStartup
inet_addr
connect
gethostbyname
htons
WSASend
CreateBitmap
DeleteDC
SaveDC
RestoreDC
SelectObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetStockObject
GetObjectA
GetDeviceCaps
ord1141
SHGetSpecialFolderPathA
DocumentPropertiesA
OpenPrinterA
ClosePrinter
ord17
Webzen
_�����ӳ���
���ӵ�������
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ