Log
sf
Behavioral task
behavioral1
Sample
b444a27a44836f91f4affaea876b92cb63ad245f0dc940b9d2bd132068426a99.dll
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
b444a27a44836f91f4affaea876b92cb63ad245f0dc940b9d2bd132068426a99.dll
Resource
win10v2004-20241007-en
Target
b444a27a44836f91f4affaea876b92cb63ad245f0dc940b9d2bd132068426a99
Size
224KB
MD5
8bd31b12330fc5d4ae276405d863f26b
SHA1
1c2e823835691ff0948ac6ed7cf09cc3043efab0
SHA256
b444a27a44836f91f4affaea876b92cb63ad245f0dc940b9d2bd132068426a99
SHA512
247c5dc78775e1042382d2aea042848fc67a023a36bc26885df24f0ba62215b390f1b0f30bf84b1fca99f882f30098f8d1ef02be8f4bbc13dc9a0a659a6bea13
SSDEEP
3072:xMxWh3aZTBt+7GO46RtmaVY812GBwX8LUdxdjd903cQeJQzs9GPmOYKtfUvYIPu:eQ7GO46YLxdjd9OFzsgCPYr
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
b444a27a44836f91f4affaea876b92cb63ad245f0dc940b9d2bd132068426a99 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Process32First
Process32Next
Sleep
GetModuleHandleA
VirtualAlloc
LoadLibraryA
VirtualFree
GetModuleFileNameA
VirtualProtect
CreateWaitableTimerA
SetWaitableTimer
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetLocalTime
GetUserDefaultLCID
ReadFile
GetFileSize
CreateFileA
GetCommandLineA
FreeLibrary
GetProcAddress
LCMapStringA
CreateToolhelp32Snapshot
CloseHandle
OpenProcess
GetCurrentProcess
GetProcessHeap
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
FlushFileBuffers
SetStdHandle
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetFilePointer
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetACP
GetCPInfo
RaiseException
IsBadWritePtr
WriteFile
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
RtlUnwind
GetVersion
LocalFree
LocalAlloc
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
CryptAcquireContextA
CryptHashData
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
InternetCloseHandle
InternetConnectA
InternetOpenA
HttpOpenRequestA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
VariantChangeType
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
Log
sf
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ