http
post
setIEproxy
Behavioral task
behavioral1
Sample
f5c243a79f932437646c24e5cf1c73cd1f03f7478cd1cde8b829ebc2f9a3f784.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral2
Sample
f5c243a79f932437646c24e5cf1c73cd1f03f7478cd1cde8b829ebc2f9a3f784.dll
Resource
win11-20250411-en
Target
f5c243a79f932437646c24e5cf1c73cd1f03f7478cd1cde8b829ebc2f9a3f784
Size
196KB
MD5
35ae76ae0eaf2f1fdcb0b0208cbafe47
SHA1
dbb997d88973370e062352d73a8eb0bc91c2349f
SHA256
f5c243a79f932437646c24e5cf1c73cd1f03f7478cd1cde8b829ebc2f9a3f784
SHA512
6f2b6e2e8c175014d89433c17b4cc31d3c1c82d3cfffda2e34a24dc01eab97440bfd6e4c3e1245cd163bcec31804cd8b27f94a863db9dc78ddfea93e27c62c99
SSDEEP
3072:5Jwy4Y+83PrXIK6HwVt88IN/3XYvtB2L1DsaTHkxkT3:5Jwy4V83PrXly8IpojGp3
resource | yara_rule |
---|---|
sample | family_blackmoon |
Checks for missing Authenticode signature.
resource |
---|
f5c243a79f932437646c24e5cf1c73cd1f03f7478cd1cde8b829ebc2f9a3f784 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
SetFilePointer
GetTickCount
Sleep
GetFileSize
SetEndOfFile
GetLocalTime
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
LCMapStringA
GetProcessHeap
WriteFile
ReadFile
GetFileSizeEx
SetFilePointerEx
CreateFileA
CreateFileW
GetFileAttributesA
GetFileAttributesW
TerminateThread
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
WaitForSingleObject
FreeLibrary
CreateThread
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersion
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MessageBoxA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
RegDeleteValueA
HttpQueryInfoA
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetGetCookieA
InternetOpenA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetConnectA
InternetSetCookieA
InternetReadFile
InternetCloseHandle
WinHttpSetTimeouts
PathFileExistsA
SystemTimeToVariantTime
VariantTimeToSystemTime
http
post
setIEproxy
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ